CVE-2026-53149: Linux Kernel

High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_property_parse_dir() does not check that content_offset + content_len fits within block_len for the root directory case. When rootdir->length equals or exceeds block_len - 2, the entry loop reads past the allocated property block. Add a bounds check after computing content_offset and content_len to reject directories whose content extends past the block.

Affected products

• Linux Linux Kernel: from 4.15, before 5.10.259 (fixed in 5.10.259); from 5.11, before 5.15.210 (fixed in 5.15.210); from 5.16, before 6.1.176 (fixed in 6.1.176); from 6.2, before 6.6.143 (fixed in 6.6.143); from 6.7, before 6.12.94 (fixed in 6.12.94); from 6.13, before 6.18.36 (fixed in 6.18.36); …

Published 2026-06-25. Last modified 2026-07-06.