7.8
HIGH
CVSS 3.1
CVE-2026-53148
thunderbolt: Clamp XDomain response data copy to allocation size
Overview
Description
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_request() derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A malicious peer can set its length field larger than the declared data_length, causing memcpy to write past the kcalloc allocation. Clamp the per-packet copy length so that the cumulative offset never exceeds data_len.
Details
INFO
Published Date :
June 25, 2026, 9:16 a.m.
Last Modified :
July 15, 2026, 1:16 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | ||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
Clamp per-packet copy length to prevent buffer overflows.
- Update the Linux kernel to include the fix.
- Verify the per-packet copy length is clamped.
- Ensure kcalloc allocations are appropriately sized.
- Validate peer-controlled lengths against data_length.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53148.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53148 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53148
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53148 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53148 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jul. 15, 2026
Action Type Old Value New Value Changed Affected [{'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'unaffected'}] [{'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'packageName': 'kernel-rt', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': 'kernel-rt', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'packageName': 'kernel-rt', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}] -
Initial Analysis by [email protected]
Jul. 08, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-787 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.176 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.143 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.210 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.94 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.15 up to (excluding) 5.10.259 Added Reference Type kernel.org: https://git.kernel.org/stable/c/05a43157676c243c248d1c6d9dcecbe6eba2f35d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/0b334279a82d79fb4723bd4f614305de1ab69caa Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/322e93448d908434ae5545660fcbe8f5a7a8e141 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/5db10c8ad8c09f72c847dfeef3d876098257f505 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6021d39ccd979713b39b980286020d8f9a45efd1 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/906035d5c3784570191d259cbf9a0ac1617852b5 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/fcbd0cdab92838854a5818be7ed8a097164ef6d5 Types: Patch Added Reference Type redhat-SADP: https://access.redhat.com/security/cve/CVE-2026-53148 Types: Third Party Advisory Added Reference Type redhat-SADP: https://bugzilla.redhat.com/show_bug.cgi?id=2492756 Types: Third Party Advisory Added Reference Type redhat-SADP: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53148.json Types: Third Party Advisory -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jun. 30, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'unaffected'}] Added CVSS V3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-787 Added Reference https://access.redhat.com/security/cve/CVE-2026-53148 Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2492756 Added Reference https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53148.json -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'cdae7c07e3e3509eaabc18c1640a55dc5b99c179', 'lessThan': '0b334279a82d79fb4723bd4f614305de1ab69caa', 'versionType': 'git'}, {'status': 'affected', 'version': 'cdae7c07e3e3509eaabc18c1640a55dc5b99c179', 'lessThan': '6021d39ccd979713b39b980286020d8f9a45efd1', 'versionType': 'git'}, {'status': 'affected', 'version': 'cdae7c07e3e3509eaabc18c1640a55dc5b99c179', 'lessThan': '89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d', 'versionType': 'git'}, {'status': 'affected', 'version': 'cdae7c07e3e3509eaabc18c1640a55dc5b99c179', 'lessThan': '5db10c8ad8c09f72c847dfeef3d876098257f505', 'versionType': 'git'}, {'status': 'affected', 'version': 'cdae7c07e3e3509eaabc18c1640a55dc5b99c179', 'lessThan': '05a43157676c243c248d1c6d9dcecbe6eba2f35d', 'versionType': 'git'}, {'status': 'affected', 'version': 'cdae7c07e3e3509eaabc18c1640a55dc5b99c179', 'lessThan': 'fcbd0cdab92838854a5818be7ed8a097164ef6d5', 'versionType': 'git'}, {'status': 'affected', 'version': 'cdae7c07e3e3509eaabc18c1640a55dc5b99c179', 'lessThan': '906035d5c3784570191d259cbf9a0ac1617852b5', 'versionType': 'git'}, {'status': 'affected', 'version': 'cdae7c07e3e3509eaabc18c1640a55dc5b99c179', 'lessThan': '322e93448d908434ae5545660fcbe8f5a7a8e141', 'versionType': 'git'}], 'programFiles': ['drivers/thunderbolt/xdomain.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.94', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/thunderbolt/xdomain.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_request() derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A malicious peer can set its length field larger than the declared data_length, causing memcpy to write past the kcalloc allocation. Clamp the per-packet copy length so that the cumulative offset never exceeds data_len. Added Reference https://git.kernel.org/stable/c/05a43157676c243c248d1c6d9dcecbe6eba2f35d Added Reference https://git.kernel.org/stable/c/0b334279a82d79fb4723bd4f614305de1ab69caa Added Reference https://git.kernel.org/stable/c/322e93448d908434ae5545660fcbe8f5a7a8e141 Added Reference https://git.kernel.org/stable/c/5db10c8ad8c09f72c847dfeef3d876098257f505 Added Reference https://git.kernel.org/stable/c/6021d39ccd979713b39b980286020d8f9a45efd1 Added Reference https://git.kernel.org/stable/c/89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d Added Reference https://git.kernel.org/stable/c/906035d5c3784570191d259cbf9a0ac1617852b5 Added Reference https://git.kernel.org/stable/c/fcbd0cdab92838854a5818be7ed8a097164ef6d5
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.