{"id":"CVE-2026-53147","state":"PUBLISHED","title":"thunderbolt: Validate XDomain request packet size before type cast","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Validate XDomain request packet size before type cast\n\ntb_xdp_handle_request() casts the received packet buffer to\nprotocol-specific structs without verifying that the allocation\nis large enough for the target type.  A peer can send a minimal\nXDomain packet that passes the generic header length check but is\nshorter than the struct accessed after the cast, causing out-of-\nbounds reads from the kmemdup allocation.\n\nPlumb the packet length through xdomain_request_work and validate\nit against the expected struct size before each cast.","publishedAt":"2026-06-25T08:38:33.547Z","updatedAt":"2026-10-19T19:57:25.830Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","status":"affected","lessThan":"a770e62923090d7572f1f5a8507ae551d354a057","versionType":"git"},{"version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","status":"affected","lessThan":"0dd61ba03d05187726ecdf9c0e2175a81b9b24f6","versionType":"git"},{"version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","status":"affected","lessThan":"79235c8add5da4bf27a12f5a5dbb579f300c059e","versionType":"git"},{"version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","status":"affected","lessThan":"46da5c3ea011e884028a91cf913db093920a915b","versionType":"git"},{"version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","status":"affected","lessThan":"07cd2787cdf8942d24a1a3ef81aa89b526fb6381","versionType":"git"},{"version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","status":"affected","lessThan":"a504b9f2797b739e0304d537e8aa4ce883ecce39","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/thunderbolt/xdomain.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.15","versionType":"semver"},{"version":"6.1.176","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.143","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.94","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.36","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.13","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/thunderbolt/xdomain.c"]}],"references":["https://git.kernel.org/stable/c/a770e62923090d7572f1f5a8507ae551d354a057","https://git.kernel.org/stable/c/0dd61ba03d05187726ecdf9c0e2175a81b9b24f6","https://git.kernel.org/stable/c/79235c8add5da4bf27a12f5a5dbb579f300c059e","https://git.kernel.org/stable/c/46da5c3ea011e884028a91cf913db093920a915b","https://git.kernel.org/stable/c/07cd2787cdf8942d24a1a3ef81aa89b526fb6381","https://git.kernel.org/stable/c/a504b9f2797b739e0304d537e8aa4ce883ecce39","https://cert-portal.siemens.com/productcert/html/ssa-784472.html"],"weaknesses":["CWE-125"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/53xxx/CVE-2026-53147.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-53147","state":"PUBLISHED","datePublished":"2026-06-25T08:38:33.547Z","dateUpdated":"2026-10-19T19:57:25.830Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-06-09T07:44:35.387Z"},"containers":{"cna":{"title":"thunderbolt: Validate XDomain request packet size before type cast","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Validate XDomain request packet size before type cast\n\ntb_xdp_handle_request() casts the received packet buffer to\nprotocol-specific structs without verifying that the allocation\nis large enough for the target type.  A peer can send a minimal\nXDomain packet that passes the generic header length check but is\nshorter than the struct accessed after the cast, causing out-of-\nbounds reads from the kmemdup allocation.\n\nPlumb the packet length through xdomain_request_work and validate\nit against the expected struct size before each cast."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","status":"affected","lessThan":"a770e62923090d7572f1f5a8507ae551d354a057","versionType":"git"},{"version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","status":"affected","lessThan":"0dd61ba03d05187726ecdf9c0e2175a81b9b24f6","versionType":"git"},{"version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","status":"affected","lessThan":"79235c8add5da4bf27a12f5a5dbb579f300c059e","versionType":"git"},{"version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","status":"affected","lessThan":"46da5c3ea011e884028a91cf913db093920a915b","versionType":"git"},{"version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","status":"affected","lessThan":"07cd2787cdf8942d24a1a3ef81aa89b526fb6381","versionType":"git"},{"version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","status":"affected","lessThan":"a504b9f2797b739e0304d537e8aa4ce883ecce39","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/thunderbolt/xdomain.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.15","versionType":"semver"},{"version":"6.1.176","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.143","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.94","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.36","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.13","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/thunderbolt/xdomain.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/a770e62923090d7572f1f5a8507ae551d354a057"},{"url":"https://git.kernel.org/stable/c/0dd61ba03d05187726ecdf9c0e2175a81b9b24f6"},{"url":"https://git.kernel.org/stable/c/79235c8add5da4bf27a12f5a5dbb579f300c059e"},{"url":"https://git.kernel.org/stable/c/46da5c3ea011e884028a91cf913db093920a915b"},{"url":"https://git.kernel.org/stable/c/07cd2787cdf8942d24a1a3ef81aa89b526fb6381"},{"url":"https://git.kernel.org/stable/c/a504b9f2797b739e0304d537e8aa4ce883ecce39"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable parser handles XDomain control packets from a directly connected Thunderbolt/USB4 peer on the same local fabric, not from a routable network. A malicious connected host, dock, or in-line device can send the malformed request packets.\nAC:L - The attacker controls the packet type, declared length, checksum, and payload size, and the generic header check accepts packets shorter than the later protocol-specific struct accesses. No race or condition outside attacker control is required once an XDomain peer is connected.\nPR:N - No target-system account or kernel capability is required; the packet is accepted from the external XDomain peer before any user credential check. XDomain must be enabled/allowed, but that is a platform configuration gate rather than attacker privilege.\nUI:N - After the malicious peer is connected, exploitation is driven entirely by packets sent over the Thunderbolt/USB4 control channel. No victim action such as opening a file or authorizing a user operation is required for the vulnerable parsing path.\nS:U - The impact is within the host kernel that processes the malformed XDomain packet. This is not a VM escape, IOMMU bypass, or cross-authority scope change.\nC:H - Short PROPERTIES_REQUEST packets cause reads past the kmemdup-allocated packet into adjacent kernel heap data, including UUID/offset fields used by the response logic. Under the required higher-severity rule for out-of-bounds reads, this is high confidentiality impact.\nI:N - The fixed bug is an out-of-bounds read before type-specific casts, not an out-of-bounds write or direct overwrite primitive. The affected paths may use the read value for response/link-state handling, but they do not provide attacker-controlled kernel memory modification.\nA:H - The malformed packet can drive kernel out-of-bounds heap reads from the control-channel workqueue and can be sent repeatedly by the peer. Such reads can fault or trigger kernel hardening/KASAN failures, so availability impact is high."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:33:30.626Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.12.94"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.18.36"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"7.0.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:22:26.452Z"},"x_adpType":"supplier"},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53147","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:25:59.896593Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-125","lang":"en","type":"CWE","description":"CWE-125 Out-of-bounds Read"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T19:57:25.830Z"}}]}}}