CVE-2026-53149: thunderbolt: Bound root directory content to block size
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Bound root directory content to block size
tbpropertyparsedir() does not check that contentoffset + contentlen fits within blocklen for the root directory case. When rootdir->length equals or exceeds blocklen - 2, the entry loop reads past the allocated property block.
Add a bounds check after computing contentoffset and contentlen to reject directories whose content extends past the block.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Configuration
Apply the fix: after computing content_offset and content_len in __tb_property_parse_dir() for the root directory case, add a bounds check to ensure content_offset + content_len fits within block_len; if it extends past block_len, reject the directory to prevent loop reads past the allocated property block.
Linux kernel (Thunderbolt) - __tb_property_parse_dir() Bounds check for root directory content = reject if content_offset + content_len exceeds block_len
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53149?
CVE-2026-53149 is considered to have a medium severity level of 5.5.
How do I fix CVE-2026-53149?
To address CVE-2026-53149, ensure that you update to the latest version of the Linux kernel that includes the fix.
What systems are affected by CVE-2026-53149?
CVE-2026-53149 affects the Linux kernel and the Microsoft azl3 kernel version 6.6.141.1-1.
What type of vulnerability is CVE-2026-53149?
CVE-2026-53149 is a vulnerability related to improper validation of directory content within the Thunderbolt subsystem of the Linux kernel.
What are the potential impacts of CVE-2026-53149?
Exploitation of CVE-2026-53149 could lead to a Denial of Service condition due to the improper handling of block size boundaries.