Cyber Resilience

CVE-2026-53150

Memory Safety in Linux Kernel 4.15 – 5.10.259

Published
25 June 2026
Modified
06 July 2026
Patch / advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0012 2th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-53150 is a medium-severity Wrap or Wraparound (CWE-191) vulnerability in Linux Linux Kernel. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject zero-length property entries in validator tb_property_entry_valid() accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes validation but causes an underflow…

more

in the null-termination logic: property->value.text[property->length * 4 - 1] = '\0'; When property->length is 0 this writes to offset -1 relative to the allocation. Reject zero-length entries early in the validator since they have no valid representation in the XDomain property protocol.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Kernel memory underflow in Thunderbolt XDomain property parsing enables local exploitation for privilege escalation via crafted device input.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-52919Same product: Linux Linux Kernel
CVE-2026-31656Same product: Linux Linux Kernel
CVE-2026-53178Same product: Linux Linux Kernel
CVE-2026-53130Same product: Linux Linux Kernel
CVE-2026-43171Same product: Linux Linux Kernel
CVE-2026-45999Same product: Linux Linux Kernel
CVE-2024-26828Same product: Linux Linux Kernel
CVE-2026-43301Same product: Linux Linux Kernel
CVE-2026-23069Same product: Linux Linux Kernel
CVE-2026-43187Same product: Linux Linux Kernel

Affected Assets

linux
linux kernel
7.1 · 4.15 — 5.10.259 · 5.11 — 5.15.210 · 5.16 — 6.1.176

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-2 Flaw Remediation
  • SI-7 Software, Firmware, and Information Integrity
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces rejection of malformed zero-length property entries before the underflow in null-termination logic can occur.

prevent

Requires timely application of the kernel patch that adds the zero-length check inside tb_property_entry_valid().

preventdetect

Verifies integrity of kernel code and data structures handling XDomain properties, limiting exploitation of the integer underflow.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices directly prevent integer underflow defects via input validation, bounds checking, and static analysis.

ID.RA-01 partial match
prevents

Vulnerability scanning and code analysis can surface underflow flaws after they are introduced.

PR.PS-02 partial match
prevents

Routine patching can remediate known underflow bugs once they are discovered in deployed software.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development catches integer underflow defects before release.

prevents

Secure development lifecycle mandates input validation and arithmetic checks that prevent integer underflow.

prevents

Application security requirements include bounds checking and safe arithmetic to avoid underflow conditions.

prevents

Secure architecture principles require defensive coding patterns that mitigate integer wraparound risks.

prevents

Secure coding standards directly prescribe safe integer handling and overflow/underflow prevention.

References