CVE-2026-98687 thunderbolt: Reject oversized XDomain properties responses
A malicious Thunderbolt peer can trigger a heap out-of-bounds read in the Linux kernel, potentially leaking memory or causing a crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98687?
CVE-2026-98687 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Reject oversized XDomain properties responses
tb_xdp_properties_request() allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set it to 63. After the fixed response fields are subtracted, the driver treats this as 48 data dwords.
Commit 322e93448d90 ("thunderbolt: Clamp XDomain response data copy to allocation size") only bounds the copy against data_len. If data_len is at least 48, memcpy() reads 192 bytes from the 180-byte res->data array, causing a 12-byte heap out-of-bounds read. Commit 4db2bd2ed478 ("thunderbolt: Limit XDomain response copy to actual frame size") limits the earlier copy but does not constrain this header-derived length.
Reject response data lengths that exceed the allocated source buffer before copying them into the assembled property block.
Which versions are affected by CVE-2026-98687?
How do I fix CVE-2026-98687?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98687 being exploited?
There is no known exploitation of CVE-2026-98687 in the wild and no public exploit code.
Sources
Also known as AZL-108953, BELL-CVE-2026-98687, DEBIAN-CVE-2026-98687, GHSA-rq3j-rw4p-w59w, UBUNTU-CVE-2026-98687.