CVE-2026-53148

Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_request() derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A malicious peer can set its length field larger than the declared data_length, causing memcpy to write past the kcalloc allocation. Clamp the per-packet copy length so that the cumulative offset never exceeds data_len.

CVSS v3.1 Score

7.0

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0014

Probability of exploitation

0.04%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-787 Out-of-bounds Write

References

Other References

https://git.kernel.org/stable/c/05a43157676c243c248d1c6d9dcecbe6eba2f35d https://git.kernel.org/stable/c/0b334279a82d79fb4723bd4f614305de1ab69caa https://git.kernel.org/stable/c/322e93448d908434ae5545660fcbe8f5a7a8e141 https://git.kernel.org/stable/c/5db10c8ad8c09f72c847dfeef3d876098257f505 https://git.kernel.org/stable/c/6021d39ccd979713b39b980286020d8f9a45efd1 https://git.kernel.org/stable/c/89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d https://git.kernel.org/stable/c/906035d5c3784570191d259cbf9a0ac1617852b5 https://git.kernel.org/stable/c/fcbd0cdab92838854a5818be7ed8a097164ef6d5 https://access.redhat.com/security/cve/CVE-2026-53148 https://bugzilla.redhat.com/show_bug.cgi?id=2492756

Frequently Asked Questions

What is CVE-2026-53148? +

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_request() derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A malicious peer can set its length field larger than the declared data_length, causing memcpy to write past the kcalloc allocation. Clamp the per-packet copy length so that the cumulative offset never exceeds data_len. It has a CVSS v3.1 base score of 7.0 (HIGH).

How severe is CVE-2026-53148? +

CVE-2026-53148 has a CVSS v3.1 score of 7.0 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0014, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-53148? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-8358

LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the …

CVE-2026-8356

LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. …

CVE-2026-6040

A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the …

CVE-2026-6039

LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a …

CVE-2026-3298

The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. …

CVE-2026-40489

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have …