Live › vulnerability › CVE-2026-98687
Go to dashboardThe Linux kernel Thunderbolt driver trusts a six-bit length field in XDomain property responses, so a malicious peer can make it copy 12 bytes past a heap buffer. The result is a heap out-of-bounds read that can leak kernel memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Thunderbolt driver, which is exposed to a malicious Thunderbolt or USB4 peer that can send XDomain responses. Machines without Thunderbolt or USB4 ports, or with the driver not loaded, are unlikely to be reachable.
No product ranges from the sources yet.
uname -r and compare it with the fixed release in the NVD entry.lsmod | grep thunderbolt.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Reject oversized XDomain properties responses
tb_xdp_properties_request() allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set it to 63. After the fixed response fields are subtracted, the driver treats this as 48 data dwords.
Commit 322e93448d90 ("thunderbolt: Clamp XDomain response data copy to allocation size") only bounds the copy against data_len. If data_len is at least 48, memcpy() reads 192 bytes from the 180-byte res->data array, causing a 12-byte heap out-of-bounds read. Commit 4db2bd2ed478 ("thunderbolt: Limit XDomain response copy to actual frame size") limits the earlier copy but does not constrain this header-derived length.
Reject response data lengths that exceed the allocated source buffer before copying them into the assembled property block.
This page as .md · .json · in your agent: get_signal("CVE-2026-98687")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.