CVE-2026-53150 (GCVE-0-2026-53150)
Vulnerability from cvelistv5 – Published: 2026-06-25 08:38 – Updated: 2026-06-25 08:38
VLAI?
Title
thunderbolt: Reject zero-length property entries in validator
Summary
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Reject zero-length property entries in validator
tb_property_entry_valid() accepts entries with length == 0 for
DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes
validation but causes an underflow in the null-termination logic:
property->value.text[property->length * 4 - 1] = '\0';
When property->length is 0 this writes to offset -1 relative to
the allocation.
Reject zero-length entries early in the validator since they have no
valid representation in the XDomain property protocol.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < 581c2053ab4dbe27e83c9e62deb4c73aa8dc0c3a
(git)
Affected: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < 35d6c9252a152e756768a26dbf216b9dd9dd8e92 (git) Affected: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < 99d9dbad1463afb510d42c9714f846361d1b726d (git) Affected: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < 5f56bc6bddffe8710ba0ba8844023b5a44ca90e4 (git) Affected: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < ca11e7da4fba4b394f69e16448f4463c44c84de6 (git) Affected: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < 2e0ddac549ebd713eb9f4a15b6496e3440a17d8b (git) Affected: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < 3b6e68cb97f725385010264a873e14a3921b6b8a (git) Affected: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < cff8eb65d1eafe7793e54b4d0cf6bf831644630b (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/property.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "581c2053ab4dbe27e83c9e62deb4c73aa8dc0c3a",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "35d6c9252a152e756768a26dbf216b9dd9dd8e92",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "99d9dbad1463afb510d42c9714f846361d1b726d",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "5f56bc6bddffe8710ba0ba8844023b5a44ca90e4",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "ca11e7da4fba4b394f69e16448f4463c44c84de6",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "2e0ddac549ebd713eb9f4a15b6496e3440a17d8b",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "3b6e68cb97f725385010264a873e14a3921b6b8a",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "cff8eb65d1eafe7793e54b4d0cf6bf831644630b",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/property.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Reject zero-length property entries in validator\n\ntb_property_entry_valid() accepts entries with length == 0 for\nDIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes\nvalidation but causes an underflow in the null-termination logic:\n\n property-\u003evalue.text[property-\u003elength * 4 - 1] = \u0027\\0\u0027;\n\nWhen property-\u003elength is 0 this writes to offset -1 relative to\nthe allocation.\n\nReject zero-length entries early in the validator since they have no\nvalid representation in the XDomain property protocol."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:38:35.531Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/581c2053ab4dbe27e83c9e62deb4c73aa8dc0c3a"
},
{
"url": "https://git.kernel.org/stable/c/35d6c9252a152e756768a26dbf216b9dd9dd8e92"
},
{
"url": "https://git.kernel.org/stable/c/99d9dbad1463afb510d42c9714f846361d1b726d"
},
{
"url": "https://git.kernel.org/stable/c/5f56bc6bddffe8710ba0ba8844023b5a44ca90e4"
},
{
"url": "https://git.kernel.org/stable/c/ca11e7da4fba4b394f69e16448f4463c44c84de6"
},
{
"url": "https://git.kernel.org/stable/c/2e0ddac549ebd713eb9f4a15b6496e3440a17d8b"
},
{
"url": "https://git.kernel.org/stable/c/3b6e68cb97f725385010264a873e14a3921b6b8a"
},
{
"url": "https://git.kernel.org/stable/c/cff8eb65d1eafe7793e54b4d0cf6bf831644630b"
}
],
"title": "thunderbolt: Reject zero-length property entries in validator",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53150",
"datePublished": "2026-06-25T08:38:35.531Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-06-25T08:38:35.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…