CVE-2026-98687

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Reject oversized XDomain properties responses

tb_xdp_properties_request() allocates room for 45 data dwords in its

252-byte response buffer. The XDomain length field is six bits wide,

however, and a malicious peer can set it to 63. After the fixed response

fields are subtracted, the driver treats this as 48 data dwords.

Commit 322e93448d90 ("thunderbolt: Clamp XDomain response data copy to

allocation size") only bounds the copy against data_len. If data_len is

at least 48, memcpy() reads 192 bytes from the 180-byte res->data array,

causing a 12-byte heap out-of-bounds read. Commit 4db2bd2ed478

("thunderbolt: Limit XDomain response copy to actual frame size") limits

the earlier copy but does not constrain this header-derived length.

Reject response data lengths that exceed the allocated source buffer

before copying them into the assembled property block.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References