Out-of-bounds read in Linux kernel - CVE-2026-98687

Vulnerability identifier: #VU157018

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98687

CWE-ID: CWE-125

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker on the local network to read beyond an allocated kernel heap buffer, potentially disclosing sensitive information.

The vulnerability exists due to an out-of-bounds read in the Linux kernel Thunderbolt driver's tb_xdp_properties_request() function when processing XDomain properties responses with oversized header-derived data lengths. A remote attacker on the local network can supply a malicious peer response with the six-bit length field set to 63 to trigger a 192-byte read from a 180-byte data array when data_len is at least 48, potentially exposing 12 bytes of adjacent kernel heap memory.

Linux kernel
SUSE Linux Micro
SUSE Linux Micro Extras
kernel-default
kernel-64kb
kernel-64kb-debugsource
kernel-64kb-devel
kernel-default-devel
kernel-syms
kernel-obs-build
kernel-obs-build-debugsource
kernel-default-debugsource
kernel-default-devel-debuginfo

Install security update from vendor's repository.

kernel-default - update to 6.4.0-159998.55.1
kernel-64kb - update to 6.4.0-159998.55.1
kernel-64kb-debugsource - update to 6.4.0-159998.55.1
kernel-64kb-devel - update to 6.4.0-159998.55.1
kernel-default-devel - update to 6.4.0-159998.55.1
kernel-syms - update to 6.4.0-159998.55.1
kernel-obs-build - update to 6.4.0-159998.55.1
kernel-obs-build-debugsource - update to 6.4.0-159998.55.1
kernel-default-debugsource - update to 6.4.0-159998.55.1
kernel-default-devel-debuginfo - update to 6.4.0-159998.55.1

• https://git.kernel.org/stable/c/2f97f929dad9eb3e1f63b721d2dd49bf9bc68efa
• https://git.kernel.org/stable/c/737a1d2e9642d5f718bd29aa4a98b9eef3832f0a
• https://git.kernel.org/stable/c/80756e263846ab694984e749e8c626897331438f
• https://git.kernel.org/stable/c/a766a86ff48acee76aeb8e2575771040749e509d
• https://git.kernel.org/stable/c/b270c1074860de74da0d6b5250fb06b359b9d509

• Out-of-bounds read in Linux kernel thunderbolt driver
• SUSE update for the Linux Kernel