---
id: CVE-2026-53147
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  thunderbolt: Validate XDomain request packet size before type cast

  tb_xdp_handle_request() casts the received packet buffer to
  protocol-specific structs without verify…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  thunderbolt: Validate XDomain request packet size before type cast

  tb_xdp_handle_request() casts the received packet buffer to
  protocol-specific structs without verify…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
cwe:
  - CWE-125
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.15, < 6.1.176'
  - 'linux_kernel >= 6.2, < 6.6.143'
  - 'linux_kernel >= 6.7, < 6.12.94'
  - 'linux_kernel >= 6.13, < 6.18.36'
  - 'linux_kernel >= 6.19, < 7.0.13'
  - linux_kernel = 7.1
patched:
  - linux_kernel 7.0.13
published: '2026-06-25'
updated: '2026-07-06'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53147'
references:
  - url: 'https://git.kernel.org/stable/c/07cd2787cdf8942d24a1a3ef81aa89b526fb6381'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0dd61ba03d05187726ecdf9c0e2175a81b9b24f6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/46da5c3ea011e884028a91cf913db093920a915b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/79235c8add5da4bf27a12f5a5dbb579f300c059e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a504b9f2797b739e0304d537e8aa4ce883ecce39'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a770e62923090d7572f1f5a8507ae551d354a057'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00268
epssPercentile: 0.19147
ingestedAt: '2026-07-06T17:44:51.348Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Validate XDomain request packet size before type cast

tb_xdp_handle_request() casts the received packet buffer to
protocol-specific structs without verifying that the allocation
is large enough for the target type.  A peer can send a minimal
XDomain packet that passes the generic header length check but is
shorter than the struct accessed after the cast, causing out-of-
bounds reads from the kmemdup allocation.

Plumb the packet length through xdomain_request_work and validate
it against the expected struct size before each cast.

## Affected

- `linux_kernel >= 4.15, < 6.1.176`
- `linux_kernel >= 6.2, < 6.6.143`
- `linux_kernel >= 6.7, < 6.12.94`
- `linux_kernel >= 6.13, < 6.18.36`
- `linux_kernel >= 6.19, < 7.0.13`
- `linux_kernel = 7.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.13`