Riskcovery

CVE-2026-53150

thunderbolt: Reject zero-length property entries in validator

State
Published
Severity
Not scored
Published
Jun 25, 2026
Updated
Oct 15, 2026
Reserved
Jun 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Reject zero-length property entries in validator

tb_property_entry_valid() accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes validation but causes an underflow in the null-termination logic:

property->value.text[property->length * 4 - 1] = '\0';

When property->length is 0 this writes to offset -1 relative to the allocation.

Reject zero-length entries early in the validator since they have no valid representation in the XDomain property protocol.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to before 581c2053ab4dbe27e83c9e62deb4c73aa8dc0c3aAffected
  • cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to before 35d6c9252a152e756768a26dbf216b9dd9dd8e92Affected
  • cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to before 99d9dbad1463afb510d42c9714f846361d1b726dAffected
  • cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to before 5f56bc6bddffe8710ba0ba8844023b5a44ca90e4Affected
  • cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to before ca11e7da4fba4b394f69e16448f4463c44c84de6Affected
  • cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to before 2e0ddac549ebd713eb9f4a15b6496e3440a17d8bAffected
  • cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to before 3b6e68cb97f725385010264a873e14a3921b6b8aAffected
  • cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to before cff8eb65d1eafe7793e54b4d0cf6bf831644630bAffected
LinuxLinux
  • 4.15Affected
  • before 4.15Not affected
  • 5.10.259 through 5.10.*Not affected
  • 5.15.210 through 5.15.*Not affected
  • 6.1.176 through 6.1.*Not affected
  • 6.6.143 through 6.6.*Not affected
  • 6.12.94 through 6.12.*Not affected
  • 6.18.36 through 6.18.*Not affected
  • 7.0.13 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.