In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses… (CVE-2026-98687)

The Linux kernel Thunderbolt driver function tb_xdp_properties_request() allocates a 252-byte buffer for response data, expecting up to 45 data dwords. However, the XDomain length field is 6 bits wide and can be set to 63 by a malicious peer, which after subtracting fixed fields is treated as 48 data dwords. This causes memcpy() to read 192 bytes from a 180-byte data array, resulting in a 12-byte heap out-of-bounds read. Previous commits limited copy sizes but did not constrain the header-derived length field. The vulnerability is fixed by rejecting response data lengths that exceed the allocated buffer before copying into the property block.

This vulnerability causes a heap out-of-bounds read in the Thunderbolt driver, which may lead to information disclosure or system instability. There is no indication of known exploits in the wild. The impact is limited to the kernel component handling Thunderbolt XDomain properties responses.

A fix has been implemented in the Linux kernel to reject oversized XDomain response data lengths before copying. Users should apply the official kernel update that includes this fix. No additional mitigation steps are indicated by the vendor advisory.