All vulnerabilities
CVE-2026-98687

Linux: thunderbolt: Reject oversized XDomain properties responses

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2f97f929dad9eb3e1f63b721d2dd49bf9bc68efaAlso 737a1d2e9642d5f718bd29aa4a98b9eef3832f0a, 80756e263846ab694984e749e8c626897331438fCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 2f97f929dad9eb3e1f63b721d2dd49bf9bc68efaLinuxCVE List
  • 737a1d2e9642d5f718bd29aa4a98b9eef3832f0aLinuxCVE List
  • 80756e263846ab694984e749e8c626897331438fLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Reject oversized XDomain properties responses

tb_xdp_properties_request() allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set it to 63. After the fixed response fields are subtracted, the driver treats this as 48 data dwords.

Commit 322e93448d90 ("thunderbolt: Clamp XDomain response data copy to allocation size") only bounds the copy against data_len. If data_len is at least 48, memcpy() reads 192 bytes from the 180-byte res->data array, causing a 12-byte heap out-of-bounds read. Commit 4db2bd2ed478 ("thunderbolt: Limit XDomain response copy to actual frame size") limits the earlier copy but does not constrain this header-derived length.

Reject response data lengths that exceed the allocated source buffer before copying them into the assembled property block.

Text from CVE List

Affected versions 12

  • Linuxaffected: d1ff70241a275133e1a0258b7c23588b122276c8 before b270c1074860de74da0d6b5250fb06b359b9d509CVE List
  • Linuxaffected: d1ff70241a275133e1a0258b7c23588b122276c8 before a766a86ff48acee76aeb8e2575771040749e509dCVE List
  • Linuxaffected: d1ff70241a275133e1a0258b7c23588b122276c8 before 2f97f929dad9eb3e1f63b721d2dd49bf9bc68efaCVE List
  • Linuxaffected: d1ff70241a275133e1a0258b7c23588b122276c8 before 737a1d2e9642d5f718bd29aa4a98b9eef3832f0aCVE List
  • Linuxaffected: d1ff70241a275133e1a0258b7c23588b122276c8 before 80756e263846ab694984e749e8c626897331438fCVE List
  • Linuxaffected: 4.15CVE List
  • Linuxunaffected: all versions before 4.15CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5