7.8

CVE-2026-53148: linux Out-of-bounds Write

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2026-53148DEBIAN-CVE-2026-53148CGA-86hv-99j2-pppq
Published 25-06-2026Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2026-53148 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in linux. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 2.6% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
0.14%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 38 · Related 38
MGASA-2026-0312OPENSUSE-SU-2026:21555-1SUSE-SU-2026:23066-1SUSE-SU-2026:23068-1SUSE-SU-2026:23193-1SUSE-SU-2026:23194-1

Timeline

  1. 25-06-2026
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_request() derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A malicious peer can set its length field larger than the declared data_length, causing memcpy to write past the kcalloc allocation. Clamp the per-packet copy length so that the cumulative offset never exceeds data_len.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

0.14%

Chance of exploitation in the next 30 days

Percentile

3%

Versus all other CVEs

30-day change

0.00 pp

From 0.14% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.14%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu167 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208 | < 6.8.0-146.146 | < 7.0.0-31.31
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124 | < 6.8.0-1066.69 | < 7.0.0-1012.12
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Chainguard6 products
  • linux-azure-6.18< 6.18.38-r0
  • linux-gcp-6.18< 6.18.38-r0
  • linux-gcp-6.18-bootc-boot-installed< 6.18.38-r0
  • linux-qemu-6.18< 6.18.38-r0
  • linux-qemu-6.18-bootc-boot-installed< 6.18.38-r0
Linux2 products
  • linux≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < 0b334279a82d79fb4723bd4f614305de1ab69caa | ≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < 6021d39ccd979713b39b980286020d8f9a45efd1 | ≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < 89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d | ≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < 5db10c8ad8c09f72c847dfeef3d876098257f505 | ≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < 05a43157676c243c248d1c6d9dcecbe6eba2f35d | ≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < fcbd0cdab92838854a5818be7ed8a097164ef6d5 | ≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < 906035d5c3784570191d259cbf9a0ac1617852b5 | ≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < 322e93448d908434ae5545660fcbe8f5a7a8e141 | 4.15
  • linux_kernel≥ 4.15, < 5.10.259 | ≥ 5.11, < 5.15.210 | ≥ 5.16, < 6.1.176 | ≥ 6.2, < 6.6.143 | ≥ 6.7, < 6.12.94 | ≥ 6.13, < 6.18.36 | ≥ 6.19, < 7.0.13 | 7.1:rc1 | 7.1:rc2 | 7.1:rc3 | 7.1:rc4 | 7.1:rc5 | 7.1:rc6 | 7.1:rc7
Debian1 product
  • linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.13-1

4 vendors · 176 products

References

43 links
Show all 43 references