CVE-2026-53146: Linux Kernel Thunderbolt XDomain Memory Disclosure Vulnerability

Technical summary

The vulnerability resides in the tb_xdomain_copy() function within the Thunderbolt subsystem. The function copies data from a DMA pool buffer using req->response_size as the copy length without validating it against the actual received frame size. When a malformed or truncated XDomain response arrives, the copy operation reads past the end of valid frame data into stale pool contents. The fix constrains the copy length to the minimum of the actual frame size and the expected response size, preventing out-of-bounds reads.

Business impact

Information disclosure from kernel memory can compromise confidentiality of sensitive data processed over Thunderbolt connections. In environments where Thunderbolt devices are present—including laptops, workstations, and external expansion systems—this vulnerability could leak cryptographic material, session tokens, or other sensitive state. Exposure is limited to adjacent network attackers with Thunderbolt access, reducing risk in managed environments but elevating concern for mobile devices and open-access facilities.

Affected systems

All Linux kernel versions that include the vulnerable Thunderbolt XDomain code path are affected. This includes desktop and laptop systems with Thunderbolt support enabled, as well as servers with Thunderbolt I/O controllers. The vulnerability does not affect systems without Thunderbolt hardware or those with Thunderbolt disabled.

Exploitability

Exploitation requires adjacent network access over Thunderbolt (AV:A). No user interaction or elevated privileges are needed, and the attack surface is determined by whether Thunderbolt is active and exposed to untrusted devices. In corporate environments with strict Thunderbolt port policies, exposure is lower; in open campus settings or BYOD scenarios, risk is elevated.

Remediation

Apply a Linux kernel update that includes the fix to tb_xdomain_copy(). Verify the patch against your kernel version's release notes or vendor advisory to confirm the exact version that resolves this issue. Until patched, disable Thunderbolt in BIOS/firmware if not operationally required, or restrict physical Thunderbolt port access to trusted devices only.

Patch guidance

Check your Linux distribution's security advisory for the kernel version that includes this fix. Patches are typically delivered through standard kernel updates. For production systems, validate the patch in a test environment first, especially if Thunderbolt functionality is critical. Kernel rebuilds from upstream source should reference commits dated after 2026-06-25 that explicitly address the XDomain copy length issue.

Detection guidance

Monitor system logs for unusual Thunderbolt device attach/detach events or XDomain communication errors that might indicate exploitation attempts. Network-based detection is difficult since the attack occurs in kernel memory handling after packet receipt. Kernel auditing tools can track memory access patterns in the Thunderbolt subsystem if configured, but practical detection relies primarily on timely patching and port access controls.

Why prioritize this

This vulnerability merits prompt attention due to its HIGH CVSS score (7.1), which reflects the combination of information disclosure (confidentiality impact) with adjacent-network reachability. While not as immediately dangerous as remote code execution, memory disclosure can serve as a stepping stone to further attacks. Priority should be elevated for mobile devices, developer workstations, and systems with untrusted Thunderbolt port exposure.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects: (1) Adjacent Network attack vector—limiting reach to local Thunderbolt networks; (2) Low attack complexity and no privilege/interaction requirements—making it straightforward to trigger; (3) High confidentiality impact from kernel memory disclosure; and (4) Low integrity impact (no payload modification). The score appropriately excludes availability since the vulnerability does not cause denial of service.

Frequently asked questions