CVE-2026-68088

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: function: rndis: add length check to response query

Add variable representations for BufLength and BufOffset in
rndis_query_response(), and perform a length check on them.

This is identical to how rndis_set_response() handles these parameters.