CVE-2026-53147 thunderbolt: Validate XDomain request packet size before type cast
A malicious Thunderbolt peer can trigger out-of-bounds reads in the Linux kernel by sending undersized XDomain packets, potentially causing information disclosure or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53147?
CVE-2026-53147 is a high-severity memory corruption vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Validate XDomain request packet size before type cast
tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter than the struct accessed after the cast, causing out-of- bounds reads from the kmemdup allocation.
Plumb the packet length through xdomain_request_work and validate it against the expected struct size before each cast.
Weakness: CWE-125
Which versions are affected by CVE-2026-53147?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53147?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-53147 being exploited?
There is no known exploitation of CVE-2026-53147 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90585, BELL-CVE-2026-53147, DEBIAN-CVE-2026-53147, GHSA-vrfr-cw9w-gwrx, ROOT-OS-DEBIAN-11-CVE-2026-53147, ROOT-OS-DEBIAN-12-CVE-2026-53147 and 3 more.