Medium 5.5Published Jun 25, 2026

CVE-2026-53150thunderbolt: Reject zero-length property entries in validator

Updated under an hour ago (Oct 28, 2026, 4:00 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject zero-length property entries in validator tb_property_entry_valid() accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes validation but causes an underflow in the null-termination logic: property->value.text[property->length * 4 - 1] = '\0'; When property->length is 0 this writes to offset -1 relative to the allocation. Reject zero-length entries early in the validator since they have no valid representation in the XDomain property protocol.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 581c2053ab4dbe27e83c9e62deb4c73aa8dc0c3a; from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 35d6c9252a152e756768a26dbf216b9dd9dd8e92; from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 99d9dbad1463afb510d42c9714f846361d1b726d; from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 5f56bc6bddffe8710ba0ba8844023b5a44ca90e4; from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before ca11e7da4fba4b394f69e16448f4463c44c84de6; from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 2e0ddac549ebd713eb9f4a15b6496e3440a17d8b; from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before 3b6e68cb97f725385010264a873e14a3921b6b8a; from cdae7c07e3e3509eaabc18c1640a55dc5b99c179 before cff8eb65d1eafe7793e54b4d0cf6bf831644630b	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.15 before 5.10.259; from 5.11 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13; 7.1; and 6 more ranges	NVD

References

References

https://git.kernel.org/stable/c/581c2053ab4dbe27e83c9e62deb4c73aa8dc0c3a	patch
https://git.kernel.org/stable/c/35d6c9252a152e756768a26dbf216b9dd9dd8e92	patch
https://git.kernel.org/stable/c/99d9dbad1463afb510d42c9714f846361d1b726d	patch
https://git.kernel.org/stable/c/5f56bc6bddffe8710ba0ba8844023b5a44ca90e4	patch
https://git.kernel.org/stable/c/ca11e7da4fba4b394f69e16448f4463c44c84de6	patch
https://git.kernel.org/stable/c/2e0ddac549ebd713eb9f4a15b6496e3440a17d8b	patch
https://git.kernel.org/stable/c/3b6e68cb97f725385010264a873e14a3921b6b8a	patch
https://git.kernel.org/stable/c/cff8eb65d1eafe7793e54b4d0cf6bf831644630b	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.