CVE-2026-53149: linux Out-of-bounds Read
Vulnerability summary
CVE-2026-53149 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 39 · Related 39Timeline
- 25-06-2026PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_property_parse_dir() does not check that content_offset + content_len fits within block_len for the root directory case. When rootdir->length equals or exceeds block_len - 2, the entry loop reads past the allocated property block. Add a bounds check after computing content_offset and content_len to reject directories whose content extends past the block.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
0.00 pp
From 0.13% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu167 products
- linuxAll versions (No fix recorded) | < 5.15.0-198.208 | < 6.8.0-146.146 | < 7.0.0-31.31
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124 | < 6.8.0-1066.69 | < 7.0.0-1012.12
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Chainguard11 products
- linux-aws-6.12< 6.12.95-r0
- linux-aws-6.18< 6.18.38-r0
- linux-azure-6.18< 6.18.38-r0
- linux-gcp-6.18< 6.18.38-r0
- linux-gcp-6.18-bootc-boot-installed< 6.18.38-r0
Linux2 products
- linux≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < 5c7657d38d07268124782f03519f07c22a5814fb | ≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < b212bc161d8a9937b42153723a4a3f2f74fab528 | ≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < 1912be23daf4afc8d24ce916021ab68ca4c679db | ≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < 4d0b1524caadb04c10a71f3f88692c63dcb39115 | ≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < 0a32040a48db8cf35de48b85d6115df5623e4964 | ≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < 60ba6217460792356a238299edd675d91d46bab4 | ≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < cbeb68cbaa0a6f979ef428a7f2d0268c082ba166 | ≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179, < 65423079c7420e3dbf9a7aa345c243a3f5752e5d | 4.15
- linux_kernel≥ 4.15, < 5.10.259 | ≥ 5.11, < 5.15.210 | ≥ 5.16, < 6.1.176 | ≥ 6.2, < 6.6.143 | ≥ 6.7, < 6.12.94 | ≥ 6.13, < 6.18.36 | ≥ 6.19, < 7.0.13 | 7.1:rc1 | 7.1:rc2 | 7.1:rc3 | 7.1:rc4 | 7.1:rc5 | 7.1:rc6 | 7.1:rc7
Debian1 product
- linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.13-1
4 vendors · 181 products
