What’s Vulnerable › Vulnerabilities

CVE-2026-53146: thunderbolt: Limit XDomain response copy to actual frame size

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-25 · updated 2026-10-19
• Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain response copy to actual frame size tb_xdomain_copy() copies req->response_size bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the valid frame data in the DMA pool buffer into stale contents from previous transactions. Use the minimum of frame size and expected response size for the copy length.

Affected products

• Linux kernel: from 4.15 before 5.10.259; from 5.11 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.94; from 6.13 before 6.18.36 — fixed in 5.10.259, 5.15.210, 6.1.176, 6.12.94, 6.18.36, 6.6.143

How to fix

Upgrade to a fixed version: Linux kernel 5.10.259, 5.15.210, 6.1.176, 6.12.94. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/033dfa63bf6be2653441a1dccae4a8313a91bb9d
• https://git.kernel.org/stable/c/4db2bd2ed4785dbadaeeab9f4e346b21ac5fb8eb
• https://git.kernel.org/stable/c/7720654b4842bcdfeb64bc002f6186041849e1e7
• https://git.kernel.org/stable/c/a15b6d3136accb2bf84b04d9a3ddd991f7fbf1cb
• https://git.kernel.org/stable/c/b2c1e5d9f1598cc1a4736d5c6bd1218f90805ee4
• https://git.kernel.org/stable/c/b5daa920f44cb582272fc9bfaeb67408776cbaef
• https://git.kernel.org/stable/c/c55da494dfb445fb28df3a9d293c2be6a299cd01
• https://git.kernel.org/stable/c/fc261397295b8ad0654cec747b0ec25ea0011995
• https://cert-portal.siemens.com/productcert/html/ssa-784472.html

Get alerted when CVE-2026-53146 or the next vulnerability affects your stack