847 matches found
CVE-2026-63892 thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...
CVE-2026-63892
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...
CVE-2026-63891
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...
CVE-2026-63891 thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...
CVE-2026-63891 thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...
EUVD-2026-45664
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...
CVE-2026-63891
The CVE affects the Linux kernel Thunderbolt property parser. A crafted peer can trigger a back‑reference loop in DIRECTORY entries, exhausting stack via __tb_property_parse_dir() because the value is used as dir_offset without a depth counter. The fix threads a depth counter through tb_property_...
PT-2026-61209
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the thunderbolt property handling where the tb property parse dir function fails to properly validate the dir len value derived from entry-length. When dir len is less...
PT-2026-61208
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the thunderbolt component where the tb property parse dir function lacks a recursion depth counter when processing DIRECTORY entries. A malicious XDomain peer can crea...
PT-2026-61210
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer wrap occurs in the tb property entry valid function when calculating the sum of entry-value u32 and entry-length u16. A malicious XDomain peer can provide specific values that...
CVE-2026-53146
A flaw was found in the Linux kernel's Thunderbolt subsystem. A malicious or compromised Thunderbolt/USB4 peer can send a specially crafted, short response. This causes the tbxdomaincopy function to read beyond the valid data in the received frame, potentially exposing stale contents from previou...
Linux Distros Unpatched Vulnerability : CVE-2026-53147
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: Validate XDomain request packet size before type cast tbxdphandlerequest casts the received packet buffer to protocol-specific structs without...
Linux Distros Unpatched Vulnerability : CVE-2026-53148
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: Clamp XDomain response data copy to allocation size tbxdppropertiesrequest derives the per-packet copy length from the response header without...
Linux Distros Unpatched Vulnerability : CVE-2026-53149
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: Bound root directory content to block size tbpropertyparsedir does not check that contentoffset + contentlen fits within blocklen for the root...
Linux Distros Unpatched Vulnerability : CVE-2026-53150
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: Reject zero-length property entries in validator tbpropertyentryvalid accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A...
Linux Distros Unpatched Vulnerability : CVE-2026-53146
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: Limit XDomain response copy to actual frame size tbxdomaincopy copies req-responsesize bytes from the received packet buffer regardless of the actu...
Linux Distros Unpatched Vulnerability : CVE-2026-53164
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/dma: Do not try to iommumap a 0 length region in swiotlb iommudmaiovalinkswiotlb processes a mapping that is unaligned in three parts, the head, middle an...
thunderbolt: Clamp XDomain response data copy to allocation size
...