CVE-2026-53149

A flaw was found in the Linux kernel's Thunderbolt driver. The __tb_property_parse_dir() function, responsible for parsing root directory content, does not properly validate the size of the content against the allocated block size. This oversight allows the system to read beyond the intended memory boundary when processing certain root directory lengths, potentially leading to a buffer over-read vulnerability. This could result in information disclosure or system instability.

This vulnerability is evaluated as having a Moderate impact for Red Hat environments because successful exploitation requires either local system access or physical attachment of a crafted device, preventing remote unauthenticated compromise. In standard enterprise server installations, Thunderbolt hardware is rarely deployed, significantly reducing the exposure surface. When triggered by malformed device properties, the flaw primarily leads to an out-of-bounds read that may result in denial of service through a system crash rather than arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.