Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-53147

thunderbolt: Validate XDomain request packet size before type cast

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter than the struct accessed after the cast, causing out-of- bounds reads from the kmemdup allocation. Plumb the packet length through xdomain_request_work and validate it against the expected struct size before each cast.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to < a770e62923090d7572f1f5a8507ae551d354a057affected
  • cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to < 0dd61ba03d05187726ecdf9c0e2175a81b9b24f6affected
  • cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to < 79235c8add5da4bf27a12f5a5dbb579f300c059eaffected
  • cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to < 46da5c3ea011e884028a91cf913db093920a915baffected
  • cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to < 07cd2787cdf8942d24a1a3ef81aa89b526fb6381affected
  • cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to < a504b9f2797b739e0304d537e8aa4ce883ecce39affected

Linux Linux

Default version status: affected

  • 4.15affected
  • 0 to < 4.15unaffected
  • 6.1.176 to ≤ 6.1.*unaffected
  • 6.6.143 to ≤ 6.6.*unaffected
  • 6.12.94 to ≤ 6.12.*unaffected
  • 6.18.36 to ≤ 6.18.*unaffected
  • 7.0.13 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References