{"id":"CVE-2026-53146","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Limit XDomain response copy to actual frame size\n\ntb_xdomain_copy() copies req->response_size bytes from the received\npacket buffer regardless of the actua…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Limit XDomain response copy to actual frame size\n\ntb_xdomain_copy() copies req->response_size bytes from the received\npacket buffer regardless of the actua…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 4.15, < 5.10.259","linux_kernel >= 5.11, < 5.15.210","linux_kernel >= 5.16, < 6.1.176","linux_kernel >= 6.2, < 6.6.143","linux_kernel >= 6.7, < 6.12.94","linux_kernel >= 6.13, < 6.18.36","linux_kernel >= 6.19, < 7.0.13","linux_kernel = 7.1"],"patched":["linux_kernel 7.0.13"],"published":"2026-06-25","updated":"2026-07-06","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53146","references":[{"url":"https://git.kernel.org/stable/c/033dfa63bf6be2653441a1dccae4a8313a91bb9d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4db2bd2ed4785dbadaeeab9f4e346b21ac5fb8eb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7720654b4842bcdfeb64bc002f6186041849e1e7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a15b6d3136accb2bf84b04d9a3ddd991f7fbf1cb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2c1e5d9f1598cc1a4736d5c6bd1218f90805ee4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5daa920f44cb582272fc9bfaeb67408776cbaef","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c55da494dfb445fb28df3a9d293c2be6a299cd01","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc261397295b8ad0654cec747b0ec25ea0011995","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00242,"epssPercentile":0.15673,"ingestedAt":"2026-07-06T17:44:51.345Z","slug":"CVE-2026-53146","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Limit XDomain response copy to actual frame size\n\ntb_xdomain_copy() copies req->response_size bytes from the received\npacket buffer regardless of the actual frame size.  When a short\nresponse arrives, this reads past the valid frame data in the DMA\npool buffer into stale contents from previous transactions.\n\nUse the minimum of frame size and expected response size for the\ncopy length.\n\n## Affected\n\n- `linux_kernel >= 4.15, < 5.10.259`\n- `linux_kernel >= 5.11, < 5.15.210`\n- `linux_kernel >= 5.16, < 6.1.176`\n- `linux_kernel >= 6.2, < 6.6.143`\n- `linux_kernel >= 6.7, < 6.12.94`\n- `linux_kernel >= 6.13, < 6.18.36`\n- `linux_kernel >= 6.19, < 7.0.13`\n- `linux_kernel = 7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.13`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}