VULNERABILITY INTELLIGENCE

CVE-2026-53150

CVSS score5.5 MEDIUM
EPSS probability0.13%
CISA KEVNot currently listed
Published2026-06-25
Last modified2026-10-15
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject zero-length property entries in validator tb_property_entry_valid() accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes validation but causes an underflow in the null-termination logic: property->value.text[property->length * 4 - 1] = '\0'; When property->length is 0 this writes to offset -1 relative to the allocation. Reject zero-length entries early in the validator since they have no valid representation in the XDomain property protocol.

Weakness classification

  • nvd@nist.gov: CWE-191

Primary references