In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Clamp XDomain response data copy to allocation size

tb_xdp_properties_request() derives the per-packet copy length from
the response header without checking that it fits in the previously
allocated data buffer. A malicious peer can set its length field
larger than the declared data_length, causing memcpy to write past
the kcalloc allocation.

Clamp the per-packet copy length so that the cumulative offset
never exceeds data_len.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < 0b334279a82d79fb4723bd4f614305de1ab69caa
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < 6021d39ccd979713b39b980286020d8f9a45efd1
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < 89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < 5db10c8ad8c09f72c847dfeef3d876098257f505
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < 05a43157676c243c248d1c6d9dcecbe6eba2f35d
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < fcbd0cdab92838854a5818be7ed8a097164ef6d5
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < 906035d5c3784570191d259cbf9a0ac1617852b5
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < 322e93448d908434ae5545660fcbe8f5a7a8e141
Linux Linux affected
Version Status Constraints
4.15 affected —
0 unaffected < 4.15
5.10.259 unaffected ≤ 5.10.*
5.15.210 unaffected ≤ 5.15.*
6.1.176 unaffected ≤ 6.1.*
6.6.143 unaffected ≤ 6.6.*
6.12.94 unaffected ≤ 6.12.*
6.18.36 unaffected ≤ 6.18.*
7.0.13 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/05a43157676c243c248d1c6d9dcecbe6eba2f35d cve-icon
https://git.kernel.org/stable/c/0b334279a82d79fb4723bd4f614305de1ab69caa cve-icon
https://git.kernel.org/stable/c/322e93448d908434ae5545660fcbe8f5a7a8e141 cve-icon
https://git.kernel.org/stable/c/5db10c8ad8c09f72c847dfeef3d876098257f505 cve-icon
https://git.kernel.org/stable/c/6021d39ccd979713b39b980286020d8f9a45efd1 cve-icon
https://git.kernel.org/stable/c/89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d cve-icon
https://git.kernel.org/stable/c/906035d5c3784570191d259cbf9a0ac1617852b5 cve-icon
https://git.kernel.org/stable/c/fcbd0cdab92838854a5818be7ed8a097164ef6d5 cve-icon
History

Thu, 25 Jun 2026 10:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-787

Thu, 25 Jun 2026 09:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_request() derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A malicious peer can set its length field larger than the declared data_length, causing memcpy to write past the kcalloc allocation. Clamp the per-packet copy length so that the cumulative offset never exceeds data_len.
Title thunderbolt: Clamp XDomain response data copy to allocation size
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-06-25T08:38:34.208Z

Reserved: 2026-06-09T07:44:35.387Z

Link: CVE-2026-53148

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-25T10:30:17Z

Weaknesses