CVE-2026-98687

A flaw was found in the Linux kernel's Thunderbolt driver. When processing property requests from peer devices, the driver fails to verify that the response data length does not exceed the allocated buffer size. A malicious peer can exploit this flaw by sending an oversized response packet, triggering an out-of-bounds read from heap memory. This issue may allow an attacker to disclose sensitive kernel memory or cause a Denial of Service (DoS) by crashing the system.

This vulnerability is evaluated as Moderate severity because successful exploitation requires physical access to connect a malicious Thunderbolt or USB4 device, or control over a virtualized hardware bus. The out-of-bounds heap read may result in system instability, kernel panics causing denial of service, or limited kernel memory leakage, but it cannot be triggered across standard network interfaces. Enterprise server deployments that operate in physically secured environments or lack Thunderbolt-capable hardware face minimal operational risk from this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.