CVE-2026-53146: thunderbolt: Limit XDomain response copy to actual frame size
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Limit XDomain response copy to actual frame size
tbxdomaincopy() copies req->responsesize bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the valid frame data in the DMA pool buffer into stale contents from previous transactions.
Use the minimum of frame size and expected response size for the copy length.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running an affected Linux kernel or Microsoft azl3 kernel with Thunderbolt XDomain functionality exposed are relevant. The attack vector is adjacent, so an attacker must be able to interact through the applicable adjacent Thunderbolt/XDomain path.
What does an attacker need to do to exploit it?
No privileges or user interaction are required according to the supplied vector. Exploitation involves causing a short XDomain response, which makes the kernel copy beyond the valid received frame into stale DMA-pool contents.
What is the potential impact?
The issue can disclose highly sensitive stale contents from previous DMA-pool transactions. It also has a low integrity impact, while no availability impact is indicated.
What should be done if patching cannot happen immediately?
The provided data identifies a patch as available. No specific temporary mitigation or configuration workaround is provided.