CVE-2026-53148: thunderbolt: Clamp XDomain response data copy to allocation size
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Clamp XDomain response data copy to allocation size
tbxdppropertiesrequest() derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A malicious peer can set its length field larger than the declared datalength, causing memcpy to write past the kcalloc allocation.
Clamp the per-packet copy length so that the cumulative offset never exceeds datalen.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Compensating control
Clamp the per-packet XDomain response data copy length in thunderbolt:XDomain response handling (tb_xdp_properties_request()) so the cumulative offset never exceeds the allocated data buffer size (data_len), ensuring memcpy does not write past the allocation.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is rated with local attack vector and low privileges required. No user interaction is required, and exploitation involves a malicious peer supplying an oversized response length.
What is the potential impact of successful exploitation?
The out-of-bounds write can affect confidentiality, integrity, and availability, each rated High in the provided severity vector.
Which software is identified as affected?
The listed software includes the Linux kernel and Microsoft azl3 kernel version 6.6.141.1-1.