CVE-2026-53147

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Validate XDomain request packet size before type cast

tb_xdp_handle_request() casts the received packet buffer to

protocol-specific structs without verifying that the allocation

is large enough for the target type. A peer can send a minimal

XDomain packet that passes the generic header length check but is

shorter than the struct accessed after the cast, causing out-of-

bounds reads from the kmemdup allocation.

Plumb the packet length through xdomain_request_work and validate

it against the expected struct size before each cast.