CVE-2026-53147
published 2026-06-25CVE-2026-53147: In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request()…
PriorityP343high8.1CVSS 3.1
AVAACLPRNUINSUCHINAH
EPSS
0.28%
20.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Validate XDomain request packet size before type cast
tb_xdp_handle_request() casts the received packet buffer to
protocol-specific structs without verifying that the allocation
is large enough for the target type. A peer can send a minimal
XDomain packet that passes the generic header length check but is
shorter than the struct accessed after the cast, causing out-of-
bounds reads from the kmemdup allocation.
Plumb the packet length through xdomain_request_work and validate
it against the expected struct size before each cast.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= cdae7c07e3e3509eaabc18c1640a55dc5b99c179 < a770e62923090d7572f1f5a8507ae551d354a057 | a770e62923090d7572f1f5a8507ae551d354a057 |
| linux | linux | >= cdae7c07e3e3509eaabc18c1640a55dc5b99c179 < 0dd61ba03d05187726ecdf9c0e2175a81b9b24f6 | 0dd61ba03d05187726ecdf9c0e2175a81b9b24f6 |
| linux | linux | >= cdae7c07e3e3509eaabc18c1640a55dc5b99c179 < 79235c8add5da4bf27a12f5a5dbb579f300c059e | 79235c8add5da4bf27a12f5a5dbb579f300c059e |
| linux | linux | >= cdae7c07e3e3509eaabc18c1640a55dc5b99c179 < 46da5c3ea011e884028a91cf913db093920a915b | 46da5c3ea011e884028a91cf913db093920a915b |
| linux | linux | >= cdae7c07e3e3509eaabc18c1640a55dc5b99c179 < 07cd2787cdf8942d24a1a3ef81aa89b526fb6381 | 07cd2787cdf8942d24a1a3ef81aa89b526fb6381 |
| linux | linux | >= cdae7c07e3e3509eaabc18c1640a55dc5b99c179 < a504b9f2797b739e0304d537e8aa4ce883ecce39 | a504b9f2797b739e0304d537e8aa4ce883ecce39 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 4.15 < 6.1.176 | 6.1.176 |
| linux | linux_kernel | >= 6.13 < 6.18.36 | 6.18.36 |
| linux | linux_kernel | >= 6.19 < 7.0.13 | 7.0.13 |
| linux | linux_kernel | >= 6.2 < 6.6.143 | 6.6.143 |
| linux | linux_kernel | >= 6.7 < 6.12.94 | 6.12.94 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: thunderbolt: Validate XDomain request packet size before type cast
vendor_redhat·2026-06-25·CVSS 5.5
CVE-2026-53147 [MEDIUM] CWE-125 kernel: thunderbolt: Validate XDomain request packet size before type cast
kernel: thunderbolt: Validate XDomain request packet size before type cast
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Validate XDomain request packet size before type cast
tb_xdp_handle_request() casts the received packet buffer to
protocol-specific structs without verifying that the allocation
is large enough for the target type. A peer can send a minimal
XDomain packet that passes the generic header length check but is
shorter than the struct accessed after the cast, causing out-of-
bounds reads from the kmemdup allocation.
Plumb the packet length through xdomain_request_work and validate
it against the expected struct size before each cast.
A flaw was found in the Linux kernel's Thunderbolt component. A remote attacker could exploit this vulnerabi
VulDB
Linux Kernel up to 7.0.12 thunderbolt tb_xdp_handle_request buffer overflow (Nessus ID 323579 / WID-SEC-2026-2077)
vuldb·2026-06-29·CVSS 8.1
CVE-2026-53147 [HIGH] Linux Kernel up to 7.0.12 thunderbolt tb_xdp_handle_request buffer overflow (Nessus ID 323579 / WID-SEC-2026-2077)
A vulnerability was found in Linux Kernel up to 6.1.175/6.6.142/6.12.93/6.18.35/7.0.12 and classified as critical. This impacts the function tb_xdp_handle_request of the component thunderbolt. The manipulation results in buffer overflow.
This vulnerability is cataloged as CVE-2026-53147. The attack must originate from the local network. There is no exploit available.
It is suggested to upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request() casts the received packet buffer to pro
ghsa_unreviewed·2026-06-25
CVE-2026-53147 In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request() casts the received packet buffer to pro
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Validate XDomain request packet size before type cast
tb_xdp_handle_request() casts the received packet buffer to
protocol-specific structs without verifying that the allocation
is large enough for the target type. A peer can send a minimal
XDomain packet that passes the generic header length check but is
shorter than the struct accessed after the cast, causing out-of-
bounds reads from the kmemdup allocation.
Plumb the packet length through xdomain_request_work and validate
it against the expected struct size before each cast.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/07cd2787cdf8942d24a1a3ef81aa89b526fb6381https://git.kernel.org/stable/c/0dd61ba03d05187726ecdf9c0e2175a81b9b24f6https://git.kernel.org/stable/c/46da5c3ea011e884028a91cf913db093920a915bhttps://git.kernel.org/stable/c/79235c8add5da4bf27a12f5a5dbb579f300c059ehttps://git.kernel.org/stable/c/a504b9f2797b739e0304d537e8aa4ce883ecce39https://git.kernel.org/stable/c/a770e62923090d7572f1f5a8507ae551d354a057
2026-06-25
Published