CVE-2026-53147: thunderbolt: Validate XDomain request packet size before type cast
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Validate XDomain request packet size before type cast
tbxdphandlerequest() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter than the struct accessed after the cast, causing out-of- bounds reads from the kmemdup allocation.
Plumb the packet length through xdomainrequestwork and validate it against the expected struct size before each cast.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Compensating control
Plumb the packet length through xdomain_request_work and validate each XDomain request packet against the expected structure size before casting it, including in tb_xdp_handle_request().
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs access to a Thunderbolt XDomain peer connection and can exploit the flaw without privileges or user interaction. The attack vector is adjacent, so it is not described as remotely exploitable over a network.
What is the impact of a successful exploit?
A malformed minimal XDomain packet can trigger out-of-bounds reads from a kernel allocation. The supplied severity vector indicates high confidentiality impact and high availability impact, with no integrity impact.
What should be done if patching cannot happen immediately?
The provided data identifies the vulnerable processing path as Thunderbolt XDomain request handling. No specific temporary mitigation is provided; apply an available patch when possible.