High · published June 25, 2026
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Bound root directory content to block size
__tb_property_parse_dir() does not check that content_offset +
content_len fits within block_len for the root directory case.
When rootdir->length equals or exceeds block_len - 2, the entry
loop reads past the allocated property block.
Add a bounds check after computing content_offset and content_len
to reject directories whose content extends past the block.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.15, < 5.10.259 | 5.10.259 |
| linux/linux_kernel | ≥ 5.11, < 5.15.210 | 5.15.210 |
| linux/linux_kernel | ≥ 5.16, < 6.1.176 | 6.1.176 |
| linux/linux_kernel | ≥ 6.2, < 6.6.143 | 6.6.143 |
| linux/linux_kernel | ≥ 6.7, < 6.12.94 | 6.12.94 |
| linux/linux_kernel | ≥ 6.13, < 6.18.36 | 6.18.36 |
| linux/linux_kernel | ≥ 6.19, < 7.0.13 | 7.0.13 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |