CVE-2026-53147: thunderbolt: Validate XDomain request packet size before type cast
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Validate XDomain request packet size before type cast
tbxdphandlerequest() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter than the struct accessed after the cast, causing out-of- bounds reads from the kmemdup allocation.
Plumb the packet length through xdomainrequestwork and validate it against the expected struct size before each cast.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs access to a Thunderbolt XDomain peer connection and can exploit the flaw without privileges or user interaction. The attack vector is adjacent, so it is not described as remotely exploitable over a network.
What is the impact of a successful exploit?
A malformed minimal XDomain packet can trigger out-of-bounds reads from a kernel allocation. The supplied severity vector indicates high confidentiality impact and high availability impact, with no integrity impact.
What should be done if patching cannot happen immediately?
The provided data identifies the vulnerable processing path as Thunderbolt XDomain request handling. No specific temporary mitigation is provided; apply an available patch when possible.