In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Bound root directory content to block size

__tb_property_parse_dir() does not check that content_offset +
content_len fits within block_len for the root directory case.
When rootdir->length equals or exceeds block_len - 2, the entry
loop reads past the allocated property block.

Add a bounds check after computing content_offset and content_len
to reject directories whose content extends past the block.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < 5c7657d38d07268124782f03519f07c22a5814fb
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < b212bc161d8a9937b42153723a4a3f2f74fab528
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < 1912be23daf4afc8d24ce916021ab68ca4c679db
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < 4d0b1524caadb04c10a71f3f88692c63dcb39115
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < 0a32040a48db8cf35de48b85d6115df5623e4964
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < 60ba6217460792356a238299edd675d91d46bab4
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < cbeb68cbaa0a6f979ef428a7f2d0268c082ba166
cdae7c07e3e3509eaabc18c1640a55dc5b99c179 affected < 65423079c7420e3dbf9a7aa345c243a3f5752e5d
Linux Linux affected
Version Status Constraints
4.15 affected —
0 unaffected < 4.15
5.10.259 unaffected ≤ 5.10.*
5.15.210 unaffected ≤ 5.15.*
6.1.176 unaffected ≤ 6.1.*
6.6.143 unaffected ≤ 6.6.*
6.12.94 unaffected ≤ 6.12.*
6.18.36 unaffected ≤ 6.18.*
7.0.13 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0a32040a48db8cf35de48b85d6115df5623e4964 cve-icon
https://git.kernel.org/stable/c/1912be23daf4afc8d24ce916021ab68ca4c679db cve-icon
https://git.kernel.org/stable/c/4d0b1524caadb04c10a71f3f88692c63dcb39115 cve-icon
https://git.kernel.org/stable/c/5c7657d38d07268124782f03519f07c22a5814fb cve-icon
https://git.kernel.org/stable/c/60ba6217460792356a238299edd675d91d46bab4 cve-icon
https://git.kernel.org/stable/c/65423079c7420e3dbf9a7aa345c243a3f5752e5d cve-icon
https://git.kernel.org/stable/c/b212bc161d8a9937b42153723a4a3f2f74fab528 cve-icon
https://git.kernel.org/stable/c/cbeb68cbaa0a6f979ef428a7f2d0268c082ba166 cve-icon
History

Thu, 25 Jun 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125

Thu, 25 Jun 2026 09:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_property_parse_dir() does not check that content_offset + content_len fits within block_len for the root directory case. When rootdir->length equals or exceeds block_len - 2, the entry loop reads past the allocated property block. Add a bounds check after computing content_offset and content_len to reject directories whose content extends past the block.
Title thunderbolt: Bound root directory content to block size
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-06-25T08:38:34.869Z

Reserved: 2026-06-09T07:44:35.387Z

Link: CVE-2026-53149

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-25T12:15:03Z

Weaknesses