SB20261022285 - Out-of-bounds read in Linux kernel thunderbolt driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-98687)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to read beyond an allocated kernel heap buffer, potentially disclosing sensitive information.

The vulnerability exists due to an out-of-bounds read in the Linux kernel Thunderbolt driver's tb_xdp_properties_request() function when processing XDomain properties responses with oversized header-derived data lengths. A remote attacker on the local network can supply a malicious peer response with the six-bit length field set to 63 to trigger a 192-byte read from a 180-byte data array when data_len is at least 48, potentially exposing 12 bytes of adjacent kernel heap memory.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2f97f929dad9eb3e1f63b721d2dd49bf9bc68efa
• https://git.kernel.org/stable/c/737a1d2e9642d5f718bd29aa4a98b9eef3832f0a
• https://git.kernel.org/stable/c/80756e263846ab694984e749e8c626897331438f
• https://git.kernel.org/stable/c/a766a86ff48acee76aeb8e2575771040749e509d
• https://git.kernel.org/stable/c/b270c1074860de74da0d6b5250fb06b359b9d509