CVE-2026-53149

Analyzed Analyzed - Analysis Complete

Thunderbolt Root Directory Content Bounds Check Failure

Publication date: 2026-06-25

Last updated on: 2026-07-06

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_property_parse_dir() does not check that content_offset + content_len fits within block_len for the root directory case. When rootdir->length equals or exceeds block_len - 2, the entry loop reads past the allocated property block. Add a bounds check after computing content_offset and content_len to reject directories whose content extends past the block.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-06

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53149

EUVD

EUVD-2026-39240

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.94 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 4.15 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's thunderbolt component, specifically in the __tb_property_parse_dir() function. The function fails to verify that the sum of content_offset and content_len fits within the block_len when handling the root directory. If the root directory's length is equal to or greater than block_len minus 2, the function's entry loop reads beyond the allocated property block, potentially causing out-of-bounds memory access.

The fix involves adding a bounds check after calculating content_offset and content_len to reject directories whose content would extend past the allocated block.

Impact Analysis

This vulnerability can lead to out-of-bounds memory reads in the Linux kernel's thunderbolt property parsing code. Such memory access issues can cause system instability, crashes, or potentially be exploited to leak sensitive information or escalate privileges, depending on the context and attacker capabilities.

Hi! I’m here to help you understand CVE-2026-53149. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70