thunderbolt: Validate XDomain request packet size before type cast
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter than the struct accessed after the cast, causing out-of- bounds reads from the kmemdup allocation. Plumb the packet length through xdomain_request_work and validate it against the expected struct size before each cast.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 6.1.176, 6.12.94, 6.18.36, 6.6.143, 7.0.13
- CVEs
- CVE-2026-53147
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 03:54 UTC · Revision 1
Source evidence
thunderbolt: Validate XDomain request packet size before type cast
core-osv · Original sourcePublished 25 Jun 2026, 08:38 UTC
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter than the struct accessed after the cast, causing out-of- bounds reads from the kmemdup allocation. Plumb the packet length through xdomain_request_work and validate it against the expected struct size before each cast.
osv:CVE-2026-53147
Kernel
Fixed versions: 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13
Complete source record
{
"id": "5fde2dce02b22d1138f0914e951001e2fff09858a59aadfca5c1b94c30d05189",
"url": "https://osv.dev/vulnerability/CVE-2026-53147",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "thunderbolt: Validate XDomain request packet size before type cast",
"summary": "In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter than the struct accessed after the cast, causing out-of- bounds reads from the kmemdup allocation. Plumb the packet length through xdomain_request_work and validate it against the expected struct size before each cast.",
"evidence": "osv:CVE-2026-53147",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.1.176",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.143",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.94",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.36",
"evidence": "/affected/1/ranges"
},
{
"value": "7.0.13",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2026-53147",
"aliases": [
"CVE-2026-53147"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179"
},
{
"fixed": "a770e62923090d7572f1f5a8507ae551d354a057"
},
{
"fixed": "0dd61ba03d05187726ecdf9c0e2175a81b9b24f6"
},
{
"fixed": "79235c8add5da4bf27a12f5a5dbb579f300c059e"
},
{
"fixed": "46da5c3ea011e884028a91cf913db093920a915b"
},
{
"fixed": "07cd2787cdf8942d24a1a3ef81aa89b526fb6381"
},
{
"fixed": "a504b9f2797b739e0304d537e8aa4ce883ecce39"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53147.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.15.0"
},
{
"fixed": "6.1.176"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.143"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.94"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.36"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.0.13"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53147.json"
}
}
],
"modified": "2026-10-28T02:30:42.086314384Z",
"provider": "osv",
"references": [
"https://cert-portal.siemens.com/productcert/html/ssa-784472.html",
"https://git.kernel.org/stable/c/07cd2787cdf8942d24a1a3ef81aa89b526fb6381",
"https://git.kernel.org/stable/c/0dd61ba03d05187726ecdf9c0e2175a81b9b24f6",
"https://git.kernel.org/stable/c/46da5c3ea011e884028a91cf913db093920a915b",
"https://git.kernel.org/stable/c/79235c8add5da4bf27a12f5a5dbb579f300c059e",
"https://git.kernel.org/stable/c/a504b9f2797b739e0304d537e8aa4ce883ecce39",
"https://git.kernel.org/stable/c/a770e62923090d7572f1f5a8507ae551d354a057",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53147.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-53147",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53147.json"
}
},
"related_cves": [
{
"value": "CVE-2026-53147",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 510044,
"published_at": "2026-06-25T08:38:33.547+00:00"
}