CVE-2026-53147 Details
Description
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter than the struct accessed after the cast, causing out-of- bounds reads from the kmemdup allocation. Plumb the packet length through xdomain_request_work and validate it against the expected struct size before each cast.
A vulnerability in the Linux kernel's Thunderbolt driver allows for out-of-bounds reads due to improper validation of XDomain request packet sizes. The issue arises in the 'tb_xdp_handle_request()' function, where received packet buffers are cast to protocol-specific structures without ensuring that the allocations are sufficiently large. This flaw can be exploited by sending a minimal XDomain packet that bypasses the generic header length check but is shorter than the expected structure, leading to unauthorized memory access from the 'kmemdup' allocation. The vulnerability affects the Linux kernel stable tree.
The vulnerability has been addressed in the Linux kernel stable tree. Users should upgrade to the latest version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/07cd2787cdf8942d24a1a3ef81aa89b526fb6381 | kernel.org | Patch |
| https://git.kernel.org/stable/c/0dd61ba03d05187726ecdf9c0e2175a81b9b24f6 | kernel.org | Patch |
| https://git.kernel.org/stable/c/46da5c3ea011e884028a91cf913db093920a915b | kernel.org | Patch |
| https://git.kernel.org/stable/c/79235c8add5da4bf27a12f5a5dbb579f300c059e | kernel.org | Patch |
| https://git.kernel.org/stable/c/a504b9f2797b739e0304d537e8aa4ce883ecce39 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a770e62923090d7572f1f5a8507ae551d354a057 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.15, < 6.1.176 >= 6.2, < 6.6.143 >= 6.7, < 6.12.94 >= 6.13, < 6.18.36 >= 6.19, < 7.0.13 7.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 7.1 rc5 7.1 rc6 7.1 rc7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | Initial Analysis | [email protected] |
| Jun 28, 2026 | CVE Modified | kernel.org |
| Jun 25, 2026 | New CVE Received | kernel.org |