Linux Might Finally Disable The Microsoft RNDIS Protocol Drivers In 2026
Going back to early 2023 there were efforts to disable all the Linux drivers for Microoft's RNDIS protocol. Remote NDIS has proven to be a real security concern while superior, modern alternatives exist.
Remote Network Driver Interface Specification is the Microsoft specification built atop USB for providing a virtual Ethernet link on Windows and has been used by Linux and Android along with other platforms. RNDIS is known to be a fundamental security issue but disabling them has proven to be a drawn out process with some apparent users still left making use of the RNDIS Linux drivers.
It's been a while since last seeing activity around it but this morning Greg Kroah-Hartman once more updated the "rndis" Git branch for disabling the drivers.
This patch would disable all RNDIS protocol drivers on Linux due to being insecure:
There is also another patch in the RNDIS Git branch this morning for a potential host fix over invalid sizes.
Will 2026 finally be the year that the Linux kernel disables its insecure RNDIS drivers? We'll see...
Remote Network Driver Interface Specification is the Microsoft specification built atop USB for providing a virtual Ethernet link on Windows and has been used by Linux and Android along with other platforms. RNDIS is known to be a fundamental security issue but disabling them has proven to be a drawn out process with some apparent users still left making use of the RNDIS Linux drivers.
It's been a while since last seeing activity around it but this morning Greg Kroah-Hartman once more updated the "rndis" Git branch for disabling the drivers.
👁 RNDIS Git branch updated today
This patch would disable all RNDIS protocol drivers on Linux due to being insecure:
"The Microsoft RNDIS protocol is, as designed, insecure and vulnerable on any system that uses it with untrusted hosts or devices. Because the protocol is impossible to make secure, just disable all rndis drivers to prevent anyone from using them again.
Windows only needed this for XP and newer systems, Windows systems older than that can use the normal USB class protocols instead, which do not have these problems.
Android has had this disabled for many years so there should not be any real systems that still need this."
There is also another patch in the RNDIS Git branch this morning for a potential host fix over invalid sizes.
Will 2026 finally be the year that the Linux kernel disables its insecure RNDIS drivers? We'll see...