{"id":"CVE-2026-98687","kind":"vulnerability","aliases":["CVE-2026-98687"],"related":[],"title":"Linux kernel: oversized Thunderbolt XDomain response causes heap out-of-bounds read","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Reject oversized XDomain properties responses\n\ntb_xdp_properties_request() allocates room for 45 data dwords in its\n252-byte response buffer.  The XDomain length field is six bits wide,\nhowever, and a malicious peer can set it to 63.  After the fixed response\nfields are subtracted, the driver treats this as 48 data dwords.\n\nCommit 322e93448d90 (\"thunderbolt: Clamp XDomain response data copy to\nallocation size\") only bounds the copy against data_len.  If data_len is\nat least 48, memcpy() reads 192 bytes from the 180-byte res->data array,\ncausing a 12-byte heap out-of-bounds read.  Commit 4db2bd2ed478\n(\"thunderbolt: Limit XDomain response copy to actual frame size\") limits\nthe earlier copy but does not constrain this header-derived length.\n\nReject response data lengths that exceed the allocated source buffer\nbefore copying them into the assembled property block.","summary":"The Linux kernel Thunderbolt driver trusts a six-bit length field in XDomain property responses, so a malicious peer can make it copy 12 bytes past a heap buffer. The result is a heap out-of-bounds read that can leak kernel memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","runtime","self-hosted","thunderbolt"],"not_affected_if":["driver-not-loaded","no-thunderbolt-ports"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it with the fixed release in the NVD entry.\n- Check whether the Thunderbolt driver is loaded with `lsmod | grep thunderbolt`.","fix":"- Update the Linux kernel to a release that includes the upstream fix that rejects oversized XDomain properties responses (commit 322e93448d90 and follow-up 4db2bd2ed478 are the related history; the fixed release is unknown from the sources).","status":"open","published_at":"2026-10-18T16:17:22+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:07+00:00","updated_at":"2026-10-25T05:19:07+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:19:07Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix that rejects oversized XDomain properties responses (commit 322e93448d90 and follow-up 4db2bd2ed478 are the related history; the fixed release is unknown from the sources).","reach":"local","title":"Linux kernel: oversized Thunderbolt XDomain response causes heap out-of-bounds read","impact":"low","summary":"The Linux kernel Thunderbolt driver trusts a six-bit length field in XDomain property responses, so a malicious peer can make it copy 12 bytes past a heap buffer. The result is a heap out-of-bounds read that can leak kernel memory.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","thunderbolt","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"A malicious peer leaks 12 bytes of kernel heap memory","analyst_note":"Find the fixed kernel release and stable backport versions for the Thunderbolt XDomain fix at https://nvd.nist.gov/vuln/detail/CVE-2026-98687 and the referenced kernel commits.","how_to_check":"- Check the running kernel version with `uname -r` and compare it with the fixed release in the NVD entry.\n- Check whether the Thunderbolt driver is loaded with `lsmod | grep thunderbolt`.","needs_analyst":true,"not_affected_if":["no-thunderbolt-ports","driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the Thunderbolt driver, which is exposed to a malicious Thunderbolt or USB4 peer that can send XDomain responses. Machines without Thunderbolt or USB4 ports, or with the driver not loaded, are unlikely to be reachable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000691,"input_tokens":3563,"output_tokens":669,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98687':16A,19A '12':51B,176C '180':169C '192':165C '252':100C '322e93448':138C '45':95C '48':134C,162C '4db2bd2ed478':185C '63':121C 'actual':192C 'alloc':92C,147C,215C 'array':173C 'assembl':223C 'bit':36B,110C 'block':225C 'bound':12A,65B,150C,182C 'buffer':56B,103C,217C 'byte':52B,101C,166C,170C,177C 'caus':7A,174C 'clamp':141C 'commit':137C,184C 'constrain':202C 'copi':50B,145C,152C,190C,198C,219C 'cve':14A,17A 'd90':139C 'data':96C,135C,144C,154C,157C,172C,210C 'deriv':206C 'driver':31B,130C 'dword':97C,136C 'earlier':197C 'exceed':213C 'field':38B,107C,126C 'fix':124C 'follow':77C 'frame':193C 'header':205C 'header-deriv':204C 'heap':8A,55B,61B,178C 'host':25B 'howev':112C 'kernel':2A,20B,29B,70B,75C 'leak':69B 'least':161C 'len':155C,158C 'length':37B,106C,207C,211C 'limit':187C,195C 'linux':1A,21B,28B,74C 'make':48B 'malici':45B,115C 'memcpi':163C 'memori':71B 'out-of-bound':9A,62B,179C 'overs':3A,84C 'past':53B 'peer':46B,116C 'properti':41B,86C,90C,224C 'read':13A,66B,164C,183C 'reject':83C,208C 'request':91C 'res':171C 'resolv':81C 'respons':6A,42B,87C,102C,125C,143C,189C,209C 'result':58B 'room':93C 'runtim':22B 'self':24B 'self-host':23B 'set':118C 'six':35B,109C 'six-bit':34B 'size':148C,194C 'sourc':216C 'subtract':128C 'tb':88C 'thunderbolt':4A,26B,30B,82C,140C,186C 'treat':131C 'trust':32B 'vulner':78C 'wide':111C 'xdomain':5A,40B,85C,105C,142C,188C 'xdp':89C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Thunderbolt driver, which is exposed to a malicious Thunderbolt or USB4 peer that can send XDomain responses. Machines without Thunderbolt or USB4 ports, or with the driver not loaded, are unlikely to be reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98687","severity":null,"published_at":"2026-10-18T16:17:22+00:00","modified_at":"2026-10-21T13:21:37+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}