CVE-2026-53146: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53146 Overview

CVE-2026-53146 is an out-of-bounds read vulnerability in the Linux kernel's Thunderbolt subsystem. The flaw resides in the tb_xdomain_copy() function, which handles XDomain protocol responses between connected Thunderbolt devices. The function copies req->response_size bytes from the received packet buffer regardless of the actual frame size received. When a short response arrives, the copy operation reads past valid frame data into stale contents left in the DMA pool buffer from previous transactions. This results in unintended memory contents being processed as XDomain response data. The Linux kernel maintainers resolved the issue by limiting the copy length to the minimum of the actual frame size and the expected response size.

Critical Impact
A malicious or malformed Thunderbolt XDomain response can cause the kernel to read stale DMA buffer contents, potentially leading to information disclosure or undefined behavior in the Thunderbolt subsystem.

Affected Products

Linux kernel - Thunderbolt subsystem (drivers/thunderbolt/xdomain.c)
Multiple stable kernel branches (fixes backported across eight commits)
Systems with Thunderbolt hardware and XDomain protocol enabled

Discovery Timeline

2026-06-25 - CVE-2026-53146 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53146

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Thunderbolt XDomain response handling path. XDomain is the protocol Thunderbolt uses for peer-to-peer communication between connected hosts and devices. When a Thunderbolt device sends a response frame, tb_xdomain_copy() transfers the data from a DMA receive buffer into the requester's response structure.

The function used req->response_size — the maximum expected response length — as the copy length. It did not validate this value against the actual size of the received frame. DMA pool buffers are reused across transactions and are not zeroed between uses. A short response leaves stale data from previous Thunderbolt transactions in the unused portion of the buffer.

The upstream fix changes the copy length to min(frame_size, response_size), ensuring only the valid received bytes are transferred.

Root Cause

The root cause is missing boundary validation between the declared response size and the actual received frame size. The code trusted the requester-provided response_size field without cross-checking it against the size reported by the Thunderbolt DMA engine. Combined with the reuse of DMA pool buffers without zeroing, this allowed previous transaction data to leak into subsequent response structures.

Attack Vector

Exploitation requires the ability to send Thunderbolt XDomain frames to a vulnerable host. A connected Thunderbolt device or peer host can craft short response frames to trigger the over-read. The exposure is local and requires physical or proximity-based access to a Thunderbolt port. Successful triggering causes the kernel to consume stale DMA buffer contents as if they were valid response data, which can affect protocol parsing logic and potentially expose residual data from earlier Thunderbolt transactions.

No public exploitation code is available, and the EPSS data indicates a low predicted exploitation probability. The vulnerability is tracked across eight upstream stable-tree commits, including 033dfa63, 4db2bd2e, 7720654b, a15b6d31, b2c1e5d9, b5daa920, c55da494, and fc261397.

Detection Methods for CVE-2026-53146

Indicators of Compromise

Unexpected Thunderbolt XDomain protocol parsing errors in dmesg or kernel logs
Connection of unknown or untrusted Thunderbolt devices to managed endpoints
Anomalous Thunderbolt service discovery activity from peer hosts

Detection Strategies

Inventory running kernel versions across Linux endpoints and compare against fixed stable branches referenced in the kernel.org commits
Monitor boltctl and bolt daemon logs for unauthorized Thunderbolt device authorization events
Audit physical access policies for systems exposing Thunderbolt ports, including laptops and workstations with Thunderbolt 3 or 4

Monitoring Recommendations

Forward kernel and Thunderbolt daemon logs to a centralized log platform for correlation
Alert on new Thunderbolt device enumerations occurring outside business hours or on locked systems
Track kernel patch deployment status to confirm fixed builds are running on Thunderbolt-equipped hosts

How to Mitigate CVE-2026-53146

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution that includes the upstream fix
Restrict Thunderbolt device authorization to user-approved devices using boltctl policy settings
Disable Thunderbolt ports in firmware on systems that do not require Thunderbolt functionality

Patch Information

The fix is available in upstream Linux stable trees through commits Kernel Git Commit 033dfa63, Kernel Git Commit 4db2bd2e, Kernel Git Commit 7720654b, Kernel Git Commit a15b6d31, Kernel Git Commit b2c1e5d9, Kernel Git Commit b5daa920, Kernel Git Commit c55da494, and Kernel Git Commit fc261397. Update through your distribution's package manager once the patched kernel is available.

Workarounds

Set Thunderbolt security level to user or secure in BIOS/UEFI to require explicit device approval
Use boltctl forget to remove previously authorized devices that are no longer trusted
Physically disable Thunderbolt ports on systems in high-risk environments such as kiosks or shared workstations

bash

# Check current Thunderbolt device authorization status
boltctl list

# Set Thunderbolt policy to require user approval
boltctl config auto-enroll no

# Verify running kernel version against patched stable releases
uname -r