CVE-2026-98687: Linux Kernel Thunderbolt Buffer Overflow

CVE-2026-98687 Overview

CVE-2026-98687 is a heap out-of-bounds read vulnerability in the Linux kernel's thunderbolt driver. The flaw resides in tb_xdp_properties_request(), which handles XDomain properties responses from peer Thunderbolt devices. A malicious peer can set the six-bit XDomain length field to its maximum value of 63, causing the driver to interpret the response as containing 48 data dwords when the response buffer only allocates room for 45. The resulting memcpy() reads 192 bytes from a 180-byte source array, producing a 12-byte out-of-bounds read on the kernel heap. Previous mitigations in commits 322e93448d90 and 4db2bd2ed478 constrained other copy paths but did not validate this header-derived length.

Critical Impact
A malicious Thunderbolt peer device can trigger a 12-byte kernel heap out-of-bounds read, potentially leaking adjacent heap memory or destabilizing the kernel.

Affected Products

Linux kernel versions containing the thunderbolt XDomain properties request handler
Distributions shipping kernels prior to the fixes in commits 2f97f929dad9, 737a1d2e9642, 80756e263846, a766a86ff48a, and b270c1074860
Systems with Thunderbolt hardware exposed to untrusted peer devices

Discovery Timeline

2026-10-18 - CVE-2026-98687 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98687

Vulnerability Analysis

The Linux kernel thunderbolt driver negotiates XDomain property exchanges with connected peer devices. The function tb_xdp_properties_request() allocates a 252-byte response buffer sized to accommodate 45 data dwords plus fixed response fields. The driver then parses a length field from the response header to determine how many data dwords to copy into the assembled property block.

The XDomain length field is six bits wide, allowing values from 0 to 63. A malicious peer sets this field to 63. After the driver subtracts the fixed response fields, the computed data length becomes 48 dwords (192 bytes). The subsequent memcpy() reads 192 bytes from the res->data array, which only holds 180 bytes (45 dwords). This produces a 12-byte read past the end of the heap allocation.

Root Cause

The root cause is missing input validation on an attacker-controlled length field derived from the XDomain response header [CWE-125]. A prior fix, commit 322e93448d90 ("thunderbolt: Clamp XDomain response data copy to allocation size"), bounded the copy against data_len but did not verify that data_len itself fit within the source buffer. Commit 4db2bd2ed478 ("thunderbolt: Limit XDomain response copy to actual frame size") addressed an earlier copy but left this header-derived length unconstrained.

Attack Vector

Exploitation requires an attacker to connect a malicious Thunderbolt device to a vulnerable host. The attacker crafts an XDomain properties response with the six-bit length field set to 63. When the kernel processes the response, the out-of-bounds read copies adjacent heap memory into the assembled property block. The attack vector is physical or peripheral access rather than network-based, consistent with Thunderbolt's local-bus threat model.

No verified exploitation code is published. See the upstream commits for the complete patch logic.

Detection Methods for CVE-2026-98687

Indicators of Compromise

Unexpected thunderbolt kernel log entries referencing malformed XDomain properties responses
Kernel crashes, KASAN reports, or slab corruption warnings originating from tb_xdp_properties_request()
Connection events for unknown or untrusted Thunderbolt peripherals in system logs

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test systems to surface out-of-bounds reads in the thunderbolt subsystem
Monitor dmesg and journalctl -k for warnings referencing the thunderbolt driver or XDomain property parsing
Audit kernel versions across the fleet to identify hosts running pre-patch Thunderbolt code

Monitoring Recommendations

Alert on new USB4 or Thunderbolt device enumeration events on sensitive endpoints such as developer workstations and executive laptops
Correlate kernel crash telemetry with physical device connection events through endpoint detection and response tooling
Track vendor advisories from Linux distribution maintainers for Thunderbolt-related CVEs

How to Mitigate CVE-2026-98687

Immediate Actions Required

Apply the upstream kernel patches referenced in the Linux stable tree commits 2f97f929dad9, 737a1d2e9642, 80756e263846, a766a86ff48a, and b270c1074860
Update to a distribution kernel that incorporates these fixes once available from your vendor
Restrict physical access to Thunderbolt ports on sensitive systems until patches are deployed

Patch Information

The fix rejects XDomain response data lengths that exceed the allocated source buffer before copying them into the assembled property block. Patches are available in the following Linux kernel stable commits: Commit 2f97f929dad9, Commit 737a1d2e9642, Commit 80756e263846, Commit a766a86ff48a, and Commit b270c1074860.

Workarounds

Configure the kernel Thunderbolt security level to secure or dponly via BIOS or boltctl to require user authorization before new devices attach
Blacklist the thunderbolt kernel module on systems where Thunderbolt is not required using modprobe configuration
Disable Thunderbolt and USB4 controllers in firmware on servers and endpoints that do not need peripheral bus functionality

bash

# Configuration example
# Disable Thunderbolt module loading
echo 'blacklist thunderbolt' | sudo tee /etc/modprobe.d/blacklist-thunderbolt.conf
sudo update-initramfs -u

# Enforce user authorization for Thunderbolt devices
sudo boltctl config auth-mode enabled