CVE-2026-53147: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53147 Overview

CVE-2026-53147 is an out-of-bounds read vulnerability in the Linux kernel's Thunderbolt subsystem. The flaw resides in the tb_xdp_handle_request() function, which processes incoming XDomain protocol packets between Thunderbolt-connected hosts. The function casts received packet buffers to protocol-specific structures without first verifying that the allocated buffer is large enough for the target type. A peer device can transmit a minimal XDomain packet that satisfies the generic header length check but is smaller than the structure accessed after the type cast. The resulting out-of-bounds read occurs against the kmemdup allocation, potentially leaking adjacent kernel memory contents.

Critical Impact
A malicious or compromised Thunderbolt peer device can trigger out-of-bounds reads in kernel memory, leading to potential information disclosure from the Linux kernel heap.

Affected Products

Linux kernel — Thunderbolt subsystem (drivers/thunderbolt)
Stable kernel branches receiving backported fixes via commits 07cd2787, 0dd61ba0, 46da5c3e, 79235c8a, a504b9f2, and a770e629
Systems exposing Thunderbolt/USB4 XDomain connectivity

Discovery Timeline

2026-06-25 - CVE CVE-2026-53147 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53147

Vulnerability Analysis

The Thunderbolt XDomain protocol enables host-to-host communication between two Thunderbolt-connected systems. When a packet arrives, the kernel duplicates the buffer using kmemdup and dispatches it to tb_xdp_handle_request() for protocol decoding. The handler inspects a generic XDomain header to determine the request type, then casts the buffer pointer to one of several larger protocol-specific structures, such as those used for UUID exchange, properties requests, or link-state notifications.

The size validation performed before this cast only confirms that the buffer holds a minimal header. It does not verify that the allocation is at least as large as the target structure. An attacker controlling a connected Thunderbolt peer can craft a request whose payload terminates immediately after the generic header. Subsequent field accesses on the casted struct then read past the end of the kmemdup allocation, returning adjacent slab data to the protocol logic.

Root Cause

The root cause is missing length validation between a generic header check and a subsequent type cast [CWE-125]. The function trusted that any packet passing the initial check would also be large enough for the more specific protocol struct. The upstream fix plumbs the actual packet length through xdomain_request_work and validates it against sizeof(struct ...) before each cast.

Attack Vector

Exploitation requires the attacker to control a device on the other end of a Thunderbolt link, such as a malicious dock, peripheral, or compromised host. Once connected, the peer sends an undersized but header-valid XDomain request. The vulnerable handler reads beyond the allocation boundary, exposing kernel heap contents that may be returned in protocol responses or used in subsequent decoding logic.

No verified public exploit code is available. Refer to the upstream patch commits for technical detail on the corrected length checks.

Detection Methods for CVE-2026-53147

Indicators of Compromise

Unexpected Thunderbolt device enumeration events in dmesg or systemd journals from untrusted peripherals.
Kernel warnings, KASAN reports, or slab corruption messages referencing tb_xdp_handle_request or thunderbolt modules.
Connection attempts from unknown Thunderbolt hosts logged by boltd or the thunderbolt udev subsystem.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test systems to surface out-of-bounds reads in the Thunderbolt subsystem during fuzzing or validation.
Monitor running kernel versions across the fleet and flag hosts with Thunderbolt support running pre-patch builds.
Audit boltd authorization policies to identify hosts permitting automatic Thunderbolt device acceptance.

Monitoring Recommendations

Collect kernel facility syslog entries and alert on messages from the thunderbolt driver indicating malformed XDomain requests.
Track physical port events through endpoint telemetry to correlate device insertions with abnormal kernel behavior.
Inventory systems with CONFIG_USB4 or CONFIG_THUNDERBOLT enabled and prioritize them for patching.

How to Mitigate CVE-2026-53147

Immediate Actions Required

Apply the upstream kernel patches referenced in commits 07cd2787, 0dd61ba0, 46da5c3e, 79235c8a, a504b9f2, and a770e629 once available from your Linux distribution.
Restrict Thunderbolt device authorization to require explicit user approval rather than automatic acceptance.
Disable Thunderbolt or USB4 controllers on systems that do not require the functionality, particularly on multi-user or kiosk hosts.

Patch Information

The vulnerability is resolved in mainline and stable Linux kernel trees through a series of backports. The fix passes the packet length through xdomain_request_work and validates it against the expected struct size before each cast in tb_xdp_handle_request(). Reference the Kernel Git Commit 07cd2787, Kernel Git Commit 0dd61ba0, Kernel Git Commit 46da5c3e, Kernel Git Commit 79235c8a, Kernel Git Commit a504b9f2, and Kernel Git Commit a770e629 for the corrected validation logic.

Workarounds

Set Thunderbolt security level to user or secure via BIOS/UEFI to require user authorization for new devices.
Use boltctl to deauthorize unknown devices and clear stored authorizations for untrusted peripherals.
Physically block or disable Thunderbolt ports on systems located in untrusted environments where peripherals cannot be controlled.

bash

# Configuration example
# Check Thunderbolt device authorization status
boltctl list

# Set policy to require manual authorization for new devices
boltctl config auto-enroll no

# Forget a previously authorized untrusted device
boltctl forget <device-uuid>