Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-25T00:00:00 kernel: thunderbolt: Reject zero-length property entries in validator 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-191

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject zero-length property entries in validator tb_property_entry_valid() accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes validation but causes an underflow in the null-termination logic: property->value.text[property->length * 4 - 1] = '\0'; When property->length is 0 this writes to offset -1 relative to the allocation. Reject zero-length entries early in the validator since they have no valid representation in the XDomain property protocol.

A flaw was found in the Linux kernel's Thunderbolt subsystem. The `tb_property_entry_valid()` function, which validates Thunderbolt property entries, accepts zero-length TEXT entries. This can cause an underflow in the null-termination logic, resulting in an out-of-bounds write to memory. This memory corruption could lead to a denial of service (system crash) or potentially allow for privilege escalation.

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-53150 https://nvd.nist.gov/vuln/detail/CVE-2026-53150 https://lore.kernel.org/linux-cve-announce/2026062546-CVE-2026-53150-ee5c@gregkh/T