CVE-2026-53149

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_property_parse_dir() does not check that content_offset + content_len fits within block_len for the root directory case. When rootdir->length equals or exceeds block_len - 2, the entry loop reads past the allocated property block. Add a bounds check after computing content_offset and content_len to reject directories whose content extends past the block.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/0a32040a48db8cf35de48b85d6115df5623e4964
https://git.kernel.org/stable/c/1912be23daf4afc8d24ce916021ab68ca4c679db
https://git.kernel.org/stable/c/4d0b1524caadb04c10a71f3f88692c63dcb39115
https://git.kernel.org/stable/c/5c7657d38d07268124782f03519f07c22a5814fb
https://git.kernel.org/stable/c/60ba6217460792356a238299edd675d91d46bab4
https://git.kernel.org/stable/c/65423079c7420e3dbf9a7aa345c243a3f5752e5d
https://git.kernel.org/stable/c/b212bc161d8a9937b42153723a4a3f2f74fab528
https://git.kernel.org/stable/c/cbeb68cbaa0a6f979ef428a7f2d0268c082ba166

Configurations

No configuration.

History

25 Jun 2026, 09:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-25 09:16

Updated : 2026-06-30 14:44

NVD link : CVE-2026-53149

Mitre link : CVE-2026-53149

CVE.ORG link : CVE-2026-53149

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-53149", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179", "lessThan": "5c7657d38d07268124782f03519f07c22a5814fb", "versionType": "git"}, {"status": "affected", "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179", "lessThan": "b212bc161d8a9937b42153723a4a3f2f74fab528", "versionType": "git"}, {"status": "affected", "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179", "lessThan": "1912be23daf4afc8d24ce916021ab68ca4c679db", "versionType": "git"}, {"status": "affected", "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179", "lessThan": "4d0b1524caadb04c10a71f3f88692c63dcb39115", "versionType": "git"}, {"status": "affected", "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179", "lessThan": "0a32040a48db8cf35de48b85d6115df5623e4964", "versionType": "git"}, {"status": "affected", "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179", "lessThan": "60ba6217460792356a238299edd675d91d46bab4", "versionType": "git"}, {"status": "affected", "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179", "lessThan": "cbeb68cbaa0a6f979ef428a7f2d0268c082ba166", "versionType": "git"}, {"status": "affected", "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179", "lessThan": "65423079c7420e3dbf9a7aa345c243a3f5752e5d", "versionType": "git"}], "programFiles": ["drivers/thunderbolt/property.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.15"}, {"status": "unaffected", "version": "0", "lessThan": "4.15", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.259", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.210", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.143", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.94", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.36", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.13", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/thunderbolt/property.c"], "defaultStatus": "affected"}]}], "published": "2026-06-25T09:16:32.257", "references": [{"url": "https://git.kernel.org/stable/c/0a32040a48db8cf35de48b85d6115df5623e4964", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/1912be23daf4afc8d24ce916021ab68ca4c679db", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4d0b1524caadb04c10a71f3f88692c63dcb39115", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5c7657d38d07268124782f03519f07c22a5814fb", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/60ba6217460792356a238299edd675d91d46bab4", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/65423079c7420e3dbf9a7aa345c243a3f5752e5d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b212bc161d8a9937b42153723a4a3f2f74fab528", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cbeb68cbaa0a6f979ef428a7f2d0268c082ba166", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Bound root directory content to block size\n\n__tb_property_parse_dir() does not check that content_offset +\ncontent_len fits within block_len for the root directory case.\nWhen rootdir->length equals or exceeds block_len - 2, the entry\nloop reads past the allocated property block.\n\nAdd a bounds check after computing content_offset and content_len\nto reject directories whose content extends past the block."}], "lastModified": "2026-06-30T14:44:27.313", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}