High 7.1Published Jun 25, 2026

CVE-2026-53149thunderbolt: Bound root directory content to block size

Updated under an hour ago (Oct 27, 2026, 9:50 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_property_parse_dir() does not check that content_offset + content_len fits within block_len for the root directory case. When rootdir->length equals or exceeds block_len - 2, the entry loop reads past the allocated property block. Add a bounds check after computing content_offset and content_len to reject directories whose content extends past the block.

CVSS: 7.1 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 5c7657d38d07268124782f03519f07c22a5814fb; from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before b212bc161d8a9937b42153723a4a3f2f74fab528; from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 1912be23daf4afc8d24ce916021ab68ca4c679db; from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 4d0b1524caadb04c10a71f3f88692c63dcb39115; from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 0a32040a48db8cf35de48b85d6115df5623e4964; from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 60ba6217460792356a238299edd675d91d46bab4; from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before cbeb68cbaa0a6f979ef428a7f2d0268c082ba166; from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 65423079c7420e3dbf9a7aa345c243a3f5752e5d	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.15 before 5.10.259; from 5.11 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13; 7.1; and 6 more ranges	NVD

References

References

https://git.kernel.org/stable/c/5c7657d38d07268124782f03519f07c22a5814fb	patch
https://git.kernel.org/stable/c/b212bc161d8a9937b42153723a4a3f2f74fab528	patch
https://git.kernel.org/stable/c/1912be23daf4afc8d24ce916021ab68ca4c679db	patch
https://git.kernel.org/stable/c/4d0b1524caadb04c10a71f3f88692c63dcb39115	patch
https://git.kernel.org/stable/c/0a32040a48db8cf35de48b85d6115df5623e4964	patch
https://git.kernel.org/stable/c/60ba6217460792356a238299edd675d91d46bab4	patch
https://git.kernel.org/stable/c/cbeb68cbaa0a6f979ef428a7f2d0268c082ba166	patch
https://git.kernel.org/stable/c/65423079c7420e3dbf9a7aa345c243a3f5752e5d	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.