CVE-2026-53148 - Vulnerability Details

- thunderbolt: Clamp XDomain response data copy to allocation size

Description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Clamp XDomain response data copy to allocation size

tb_xdp_properties_request() derives the per-packet copy length from
the response header without checking that it fits in the previously
allocated data buffer. A malicious peer can set its length field
larger than the declared data_length, causing memcpy to write past
the kcalloc allocation.

Clamp the per-packet copy length so that the cumulative offset
never exceeds data_len.

Published: 2026-06-25

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A bug in the Thunderbolt XDP properties request handler causes the driver to copy data from a peer without checking that the per‑packet length fits within the buffer previously allocated. The resulting memcpy operation can overwrite memory beyond the allocated region, corrupting kernel data structures or executing arbitrary code. This is a classic out‑of‑bounds write vulnerability.

Affected Systems

The flaw resides in the Linux kernel’s Thunderbolt subsystem. No specific kernel releases are listed in the CVE record, so affected systems are those running any Linux kernel version that contains the vulnerable tb_xdp_properties_request implementation before the patch commits cited in the advisory.

Risk and Exploitability

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, but the lack of bounds checking combined with a CVSS score of 7.0 indicates a high severity. The likely attack vector is a malicious Thunderbolt device that can send crafted packets to the host; this is inferred from the driver. If an attacker can supply such data, they could cause memory corruption that leads to privilege escalation or denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cdae7c07e3e3509eaabc18c1640a55dc5b99c179`	affected	< 0b334279a82d79fb4723bd4f614305de1ab69caa
`cdae7c07e3e3509eaabc18c1640a55dc5b99c179`	affected	< 6021d39ccd979713b39b980286020d8f9a45efd1
`cdae7c07e3e3509eaabc18c1640a55dc5b99c179`	affected	< 89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d
`cdae7c07e3e3509eaabc18c1640a55dc5b99c179`	affected	< 5db10c8ad8c09f72c847dfeef3d876098257f505
`cdae7c07e3e3509eaabc18c1640a55dc5b99c179`	affected	< 05a43157676c243c248d1c6d9dcecbe6eba2f35d
`cdae7c07e3e3509eaabc18c1640a55dc5b99c179`	affected	< fcbd0cdab92838854a5818be7ed8a097164ef6d5
`cdae7c07e3e3509eaabc18c1640a55dc5b99c179`	affected	< 906035d5c3784570191d259cbf9a0ac1617852b5
`cdae7c07e3e3509eaabc18c1640a55dc5b99c179`	affected	< 322e93448d908434ae5545660fcbe8f5a7a8e141

Linux

affected

Version	Status	Constraints
`4.15`	affected	—
`0`	unaffected	< 4.15
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[cdae7c07e3e3509eaabc18c1640a55dc5b99c179,0b334279a82d79fb4723bd4f614305de1ab69caa)`	affected	code_commit	—
`[cdae7c07e3e3509eaabc18c1640a55dc5b99c179,6021d39ccd979713b39b980286020d8f9a45efd1)`	affected	code_commit	—
`[cdae7c07e3e3509eaabc18c1640a55dc5b99c179,89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d)`	affected	code_commit	—
`[cdae7c07e3e3509eaabc18c1640a55dc5b99c179,5db10c8ad8c09f72c847dfeef3d876098257f505)`	affected	code_commit	—
`[cdae7c07e3e3509eaabc18c1640a55dc5b99c179,05a43157676c243c248d1c6d9dcecbe6eba2f35d)`	affected	code_commit	—
`[cdae7c07e3e3509eaabc18c1640a55dc5b99c179,fcbd0cdab92838854a5818be7ed8a097164ef6d5)`	affected	code_commit	—
`[cdae7c07e3e3509eaabc18c1640a55dc5b99c179,906035d5c3784570191d259cbf9a0ac1617852b5)`	affected	code_commit	—
`[cdae7c07e3e3509eaabc18c1640a55dc5b99c179,322e93448d908434ae5545660fcbe8f5a7a8e141)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.15`	affected	generic	—
`[0,4.15)`	unaffected	generic	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.94,6.13.0)`	unaffected	semver	—
`[6.18.36,6.19.0)`	unaffected	semver	—
`[7.0.13,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to the kernel version that includes the patch commits referenced in the advisory; this removes the unchecked copy length bug.
If a kernel upgrade cannot be performed immediately, disable the Thunderbolt XDP feature or related tb_xdp_properties_request functionality by configuring the kernel to exclude those drivers or setting relevant module parameters to turn off the vulnerability component.
Continuously monitor Thunderbolt activity and kernel logs for abnormal packet lengths or errors, and apply any vendor‑issued security updates as soon as they become available.

Generated by OpenCVE AI on June 26, 2026 at 04:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00145.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/05a43157676c243c248d1c6d9dcecbe6eba2f35d
https://git.kernel.org/stable/c/0b334279a82d79fb4723bd4f614305de1ab69caa
https://git.kernel.org/stable/c/322e93448d908434ae5545660fcbe8f5a7a8e141
https://git.kernel.org/stable/c/5db10c8ad8c09f72c847dfeef3d876098257f505
https://git.kernel.org/stable/c/6021d39ccd979713b39b980286020d8f9a45efd1
https://git.kernel.org/stable/c/89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d
https://git.kernel.org/stable/c/906035d5c3784570191d259cbf9a0ac1617852b5
https://git.kernel.org/stable/c/fcbd0cdab92838854a5818be7ed8a097164ef6d5
https://lore.kernel.org/linux-cve-announce/2026062546-CVE-2026-53148-84b7@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53148
https://www.cve.org/CVERecord?id=CVE-2026-53148

History

Fri, 26 Jun 2026 03:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Fri, 26 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026062546-CVE-2026-53148-84b7@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53148 https://www.cve.org/CVERecord?id=CVE-2026-53148
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Thu, 25 Jun 2026 10:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-787

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_request() derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A malicious peer can set its length field larger than the declared data_length, causing memcpy to write past the kcalloc allocation. Clamp the per-packet copy length so that the cumulative offset never exceeds data_len.
Title		thunderbolt: Clamp XDomain response data copy to allocation size
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/05a43157676c243c248d1c6d9dcecbe6eba2f35d https://git.kernel.org/stable/c/0b334279a82d79fb4723bd4f614305de1ab69caa https://git.kernel.org/stable/c/322e93448d908434ae5545660fcbe8f5a7a8e141 https://git.kernel.org/stable/c/5db10c8ad8c09f72c847dfeef3d876098257f505 https://git.kernel.org/stable/c/6021d39ccd979713b39b980286020d8f9a45efd1 https://git.kernel.org/stable/c/89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d https://git.kernel.org/stable/c/906035d5c3784570191d259cbf9a0ac1617852b5 https://git.kernel.org/stable/c/fcbd0cdab92838854a5818be7ed8a097164ef6d5

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:38:34.208Z

Updated: 2026-07-15T00:44:48.625Z

Reserved: 2026-06-09T07:44:35.387Z

Link: CVE-2026-53148

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Important

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53148 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-26T04:45:06Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object