CVE-2026-53149 Overview
CVE-2026-53149 is an out-of-bounds read vulnerability in the Linux kernel's Thunderbolt subsystem. The flaw resides in __tb_property_parse_dir(), which fails to validate that content_offset + content_len fits within block_len when parsing the root directory case. When rootdir->length equals or exceeds block_len - 2, the entry loop reads past the allocated property block. The patch adds a bounds check after computing content_offset and content_len to reject directories whose content extends beyond the block boundary [CWE-125].
Critical Impact
A crafted Thunderbolt device property block can cause the kernel to read out-of-bounds memory, potentially leading to information disclosure or kernel instability.
Affected Products
- Linux kernel (Thunderbolt subsystem)
- Distributions shipping vulnerable kernel versions prior to the stable backport commits
- Systems with Thunderbolt hardware support enabled
Discovery Timeline
- 2026-06-25 - CVE-2026-53149 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53149
Vulnerability Analysis
The Linux kernel Thunderbolt driver parses property directories from connected devices to enumerate capabilities and identifiers. The function __tb_property_parse_dir() is responsible for walking entries inside a property block. For the root directory case, the parser computes content_offset and content_len from values present in the block header, then iterates over entries within that region.
The parser performs validation on individual entry bounds but omits a check that the computed content region itself remains inside the allocated block. When the attacker-supplied rootdir->length is large enough that content_offset + content_len exceeds block_len, the entry loop walks memory past the allocated buffer. This results in a kernel out-of-bounds read of adjacent heap memory.
Root Cause
The root cause is missing input validation in the Thunderbolt property parser. The code accepts directory length values without ensuring the derived content window fits within the validated block_len. The fix introduces a bounds check immediately after computing content_offset and content_len, rejecting any directory whose content extends past the block.
Attack Vector
Exploitation requires the ability to present a malicious Thunderbolt device or to inject crafted property block data via a connected peripheral. An attacker with physical access who plugs in a rogue Thunderbolt device can deliver malformed property data to trigger the out-of-bounds read. Successful exploitation may leak kernel memory contents or cause a kernel oops, depending on adjacent heap state.
No verified public exploit code is available for this issue. Refer to the upstream commits in the kernel.org stable tree for the precise patch diff.
Detection Methods for CVE-2026-53149
Indicators of Compromise
- Kernel log entries referencing thunderbolt parse errors or __tb_property_parse_dir warnings
- Unexpected kernel oops or KASAN reports involving the Thunderbolt property code path
- Connection events from unrecognized Thunderbolt devices on hosts containing sensitive data
Detection Strategies
- Monitor dmesg and journalctl -k output for Thunderbolt subsystem warnings or slab-out-of-bounds messages
- Enable KASAN on test kernels to catch the out-of-bounds read during fuzzing of Thunderbolt property blocks
- Correlate USB/Thunderbolt device connection telemetry with kernel error events to identify rogue peripherals
Monitoring Recommendations
- Track Thunderbolt device enumeration events through udev and audit logs to identify untrusted hardware attachments
- Alert on kernel crashes or memory protection faults originating from the thunderbolt module
- Maintain an inventory of approved Thunderbolt peripherals and flag deviations
How to Mitigate CVE-2026-53149
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits as soon as vendor builds are available
- Disable Thunderbolt support in BIOS/UEFI on systems that do not require it
- Enforce Thunderbolt security level SL1 or higher so devices require user authorization before driver enumeration
Patch Information
The fix is available in the Linux stable tree across multiple branches. Relevant commits include 0a32040a, 1912be23, 4d0b1524, 5c7657d3, 60ba6217, 65423079, b212bc16, and cbeb68cb. Distribution maintainers should backport these patches to supported kernels.
Workarounds
- Set Thunderbolt security to secure or dponly in firmware to prevent untrusted devices from presenting full property data
- Blacklist the thunderbolt kernel module on systems where the interface is unused
- Restrict physical access to Thunderbolt ports on shared or kiosk systems pending kernel updates
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
