CVE-2026-53149: Linux Kernel Thunderbolt Out-of-Bounds Read (HIGH)

Technical summary

CVE-2026-53149 is a classic out-of-bounds read vulnerability in the Linux kernel's Thunderbolt subsystem, specifically in the __tb_property_parse_dir() function. The vulnerability occurs because the function does not validate that the sum of content_offset and content_len stays within block_len when processing the root directory case. When a malicious or corrupted Thunderbolt firmware image or property data block is provided where the root directory length equals or exceeds block_len minus 2 bytes, the subsequent entry parsing loop proceeds to dereference memory outside the allocated property block. The issue is classified as CWE-125 (Out-of-bounds Read). The fix involves adding a bounds check after computing content offset and content length to reject any directory structure whose declared content extends past the physical block boundary.

Business impact

This vulnerability poses a two-fold risk to systems with Thunderbolt hardware. First, it can leak sensitive kernel memory contents to a local attacker with user-level privileges, potentially compromising cryptographic keys, session tokens, or other sensitive data resident in kernel memory. Second, it enables a local denial-of-service attack where a user can trigger a kernel panic or unrecoverable state by connecting malicious Thunderbolt devices or providing crafted firmware. Organizations managing systems with Thunderbolt controllers—particularly laptops, workstations, and servers in multi-user environments—should prioritize patching to prevent unauthorized information disclosure and maintain system availability.

Affected systems

All Linux kernel versions containing the vulnerable Thunderbolt property parsing code are affected. The vulnerability impacts systems with Thunderbolt hardware controllers that rely on the kernel's Thunderbolt subsystem to parse and validate device property blocks. This includes many modern laptops and workstations from major manufacturers, as well as some server systems with Thunderbolt expansion capabilities. The specific kernel versions containing the fix should be verified against the Linux kernel security advisories and your distribution's patch release notes.

Exploitability

The vulnerability requires local access (AV:L) and can be exploited by a standard user account (PR:L). No user interaction is required beyond triggering device enumeration or providing a malformed device. The attack surface includes scenarios where a user connects a physical Thunderbolt device under their control, or where an attacker with local system access can manipulate Thunderbolt firmware or device property data. The barrier to exploitation is relatively low once an attacker has local system access, making this a practical security concern in multi-user or bring-your-own-device environments.

Remediation

Apply the Linux kernel security patch that adds bounds validation to __tb_property_parse_dir(). The fix implements a check to ensure content_offset + content_len does not exceed block_len before processing directory entries. Verify the specific patched kernel version from your Linux distribution's security advisories. Until patching is complete, mitigate risk by restricting physical Thunderbolt port access to trusted users, disabling Thunderbolt in BIOS if the hardware is not required, or isolating systems with Thunderbolt controllers from untrusted physical environments.

Patch guidance

Identify your Linux distribution and current kernel version using 'uname -r'. Check your vendor's security advisory for the Thunderbolt subsystem fix—typically released as part of a regular kernel update or security patch. Apply kernel updates from your distribution's official repositories (e.g., apt, yum, dnf, zypper depending on your distribution). After patching, verify the new kernel is loaded and systems are rebooted. If your organization uses long-term support kernels, confirm the patch has been backported to your specific LTS branch.

Detection guidance

Monitor system logs for failed Thunderbolt device enumeration or unexpected kernel messages related to property parsing. Implement intrusion detection rules to flag repeated Thunderbolt device connection attempts from unprivileged users. Use kernel integrity monitoring tools (e.g., aide, tripwire) to detect kernel memory corruption symptoms. In forensic analysis, look for kernel memory disclosure patterns or crash dumps coinciding with Thunderbolt device activity. Network-based detection is not applicable as this is a local vulnerability; focus on endpoint telemetry and hardware event logging.

Why prioritize this

This vulnerability merits high-priority patching due to its HIGH CVSS 3.1 score (7.1) combined with low attack complexity and the dual impact of information disclosure and denial of service. The local-access-only requirement moderates urgency compared to remote flaws, but the ease of exploitation by standard users and the sensitivity of kernel memory contents justify rapid remediation. Organizations with multi-user systems, shared workstations, or BYOD programs should prioritize this patch first among local kernel vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects: Attack Vector Local (typical for hardware driver flaws), Attack Complexity Low (no special conditions required to trigger the out-of-bounds read), Privileges Required Low (standard user can exploit), User Interaction None (automatic upon device manipulation), Confidentiality High (kernel memory disclosure), Integrity None (read-only), Availability High (kernel panic/DoS possible). The combined confidentiality and availability impact drives the HIGH severity despite the local-only attack vector.

Frequently asked questions