Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-25T00:00:00 kernel: kernel: Information disclosure in Thunderbolt XDomain response handling 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-125

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain response copy to actual frame size tb_xdomain_copy() copies req->response_size bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the valid frame data in the DMA pool buffer into stale contents from previous transactions. Use the minimum of frame size and expected response size for the copy length.

A flaw was found in the Linux kernel's Thunderbolt subsystem. A malicious or compromised Thunderbolt/USB4 peer can send a specially crafted, short response. This causes the `tb_xdomain_copy()` function to read beyond the valid data in the received frame, potentially exposing stale contents from previous transactions. This out-of-bounds read primarily leads to information disclosure, with potential limited impact on data integrity or system availability.

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-53146 https://nvd.nist.gov/vuln/detail/CVE-2026-53146 https://lore.kernel.org/linux-cve-announce/2026062545-CVE-2026-53146-1e8e@gregkh/T