CVE-2026-53147
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter than the struct accessed after the cast, causing out-of- bounds reads from the kmemdup allocation. Plumb the packet length through xdomain_request_work and validate it against the expected struct size before each cast.
Schwachstellenklasse
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter than the struct accessed after the cast, causing out-of- bounds reads from the kmemdup allocation. Plumb the packet length through xdomain_request_work and validate it against the expected struct size before each cast.
Betroffene Produkte
- linux linux_kernel
Quellen
- https://git.kernel.org/stable/c/07cd2787cdf8942d24a1a3ef81aa89b526fb6381
- https://git.kernel.org/stable/c/0dd61ba03d05187726ecdf9c0e2175a81b9b24f6
- https://git.kernel.org/stable/c/46da5c3ea011e884028a91cf913db093920a915b
- https://git.kernel.org/stable/c/79235c8add5da4bf27a12f5a5dbb579f300c059e
- https://git.kernel.org/stable/c/a504b9f2797b739e0304d537e8aa4ce883ecce39
- https://git.kernel.org/stable/c/a770e62923090d7572f1f5a8507ae551d354a057
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.