CVE-2026-53150: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53150 Overview

CVE-2026-53150 is a Linux kernel vulnerability in the Thunderbolt subsystem's XDomain property protocol validator. The function tb_property_entry_valid() incorrectly accepts entries with a length of zero for DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes validation but triggers a buffer underflow during null-termination, because the code writes a null byte to offset -1 relative to the allocated buffer. This out-of-bounds write [CWE-787] occurs in kernel memory adjacent to the Thunderbolt property buffer. The issue has been resolved upstream by rejecting zero-length entries early in the validator, since they have no valid representation in the XDomain property protocol.

Critical Impact
A malicious or malformed Thunderbolt device can submit a crafted property block containing a zero-length TEXT entry, causing a kernel-space out-of-bounds write that can corrupt adjacent memory.

Affected Products

Linux kernel versions containing the unpatched tb_property_entry_valid() validation logic in the Thunderbolt driver
Systems with Thunderbolt/USB4 hardware exposing XDomain property protocol handling
Stable kernel branches addressed by the referenced commits (2e0ddac, 35d6c92, 3b6e68c, 581c205, 5f56bc6, 99d9dba, ca11e7d, cff8eb6)

Discovery Timeline

2026-06-25 - CVE-2026-53150 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53150

Vulnerability Analysis

The defect resides in the Thunderbolt XDomain property protocol validator in the Linux kernel. The validator tb_property_entry_valid() permits property entries whose length field equals zero for DIRECTORY, DATA, and TEXT types. Downstream code assumes a non-zero length when applying null-termination to text properties.

The vulnerable assignment performs the operation property->value.text[property->length * 4 - 1] = '\0';. When property->length is 0, the expression evaluates to index -1, writing a NUL byte one byte before the start of the allocated buffer. This produces a one-byte out-of-bounds write inside the kernel slab allocator.

Root Cause

The root cause is missing boundary validation in tb_property_entry_valid(). The function should reject entries with length == 0 for variable-length types, since such entries are semantically invalid under the XDomain property specification. Instead, validation accepted them and deferred to allocation and termination logic that assumed length >= 1.

Attack Vector

Exploitation requires an attacker-controlled Thunderbolt or USB4 peer device that issues a crafted XDomain property response. When the host parses the malformed property block, the validator permits the zero-length TEXT entry, and the subsequent null-termination writes outside the allocation. Physical access to a Thunderbolt port is required, aligning with documented "evil maid" and malicious peripheral threat models. Refer to the upstream patches listed in the references for the corrective diff.

Detection Methods for CVE-2026-53150

Indicators of Compromise

Kernel log messages from the Thunderbolt subsystem indicating malformed XDomain property responses or unexpected peer behavior
KASAN (Kernel Address Sanitizer) reports flagging an out-of-bounds write of size 1 within Thunderbolt property parsing code paths
Unexpected kernel panics or slab corruption coinciding with Thunderbolt device connection events

Detection Strategies

Audit kernel versions across managed Linux endpoints to identify hosts lacking the fix commits referenced in the NVD entry
Correlate Thunderbolt hot-plug events (udev/systemd-udevd logs) with subsequent kernel oops or slab allocator warnings
Enable KASAN in test environments to surface the underflow when fuzzing XDomain property payloads

Monitoring Recommendations

Forward dmesg and journald kernel facility logs to a centralized SIEM for analysis of Thunderbolt driver errors
Monitor for unauthorized Thunderbolt device connection events on endpoints handling sensitive data
Track package update status for kernel images to confirm patched builds are deployed across the fleet

How to Mitigate CVE-2026-53150

Immediate Actions Required

Update affected Linux systems to a kernel build that includes one of the fix commits listed in the NVD references
Restrict physical access to Thunderbolt and USB4 ports on systems processing sensitive workloads
Configure the Thunderbolt security level to require user authorization before new devices are accepted by the host

Patch Information

The upstream fix rejects zero-length entries inside tb_property_entry_valid() before allocation and null-termination logic executes. Patches are available across multiple stable trees via the kernel.org commits 2e0ddac, 35d6c92, 3b6e68c, 581c205, 5f56bc6, 99d9dba, ca11e7d, and cff8eb6.

Workarounds

Set the Thunderbolt security mode to secure or dponly in firmware/BIOS to prevent automatic PCIe tunneling from untrusted devices
Blacklist the thunderbolt kernel module on systems that do not require Thunderbolt connectivity using modprobe.d configuration
Enforce device authorization policies via bolt so only known Thunderbolt peers are admitted

bash

# Configuration example
# Disable Thunderbolt module loading on hosts that do not need it
echo 'blacklist thunderbolt' | sudo tee /etc/modprobe.d/blacklist-thunderbolt.conf
sudo update-initramfs -u

# Verify installed kernel version after patching
uname -r