NetSight
IP …
high7.8

CVE-2026-53148

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_request(…

Impact

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_request() derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A malicious peer can set its length field larger than the declared data_length, causing memcpy to write past the kcalloc allocation. Clamp the per-packet copy length so that the cumulative offset never exceeds data_len.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.15 before 5.10.259
from 5.11 before 5.15.210
from 5.16 before 6.1.176
from 6.2 before 6.6.143
from 6.7 before 6.12.94
from 6.13 before 6.18.36

Weakness classification

CWE-787

References