Executive brief
A vulnerability in the Linux kernel's Thunderbolt driver could allow an attacker with physical or local network access to read sensitive information from the system's memory. This occurs when the system processes certain Thunderbolt communication requests, potentially exposing data from previous system activities. Users should update their Linux kernel to the latest stable version to resolve this issue.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's Thunderbolt driver within the `tb_xdomain_copy()` function in `drivers/thunderbolt/xdomain.c`. The function copies a fixed number of bytes (`req->response_size`) from the received packet buffer without verifying the actual size of the received frame. If a 'short' response is received, the `memcpy` operation continues past the valid frame data into the DMA pool buffer, potentially exposing stale data from previous transactions. This is a classic information disclosure bug where an attacker could potentially observe sensitive kernel memory contents. Patches have been released across multiple stable kernel branches (e.g., 5.10.259, 5.15.210, 6.1.176, 6.6.34, 6.9.5).
Affected products
- Linux Linux Kernel 4.15 to 6.9.5
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory
References
- https://git.kernel.org/stable/c/033dfa63bf6be2653441a1dccae4a8313a91bb9d
- https://git.kernel.org/stable/c/4db2bd2ed4785dbadaeeab9f4e346b21ac5fb8eb
- https://git.kernel.org/stable/c/7720654b4842bcdfeb64bc002f6186041849e1e7
- https://git.kernel.org/stable/c/a15b6d3136accb2bf84b04d9a3ddd991f7fbf1cb
- https://git.kernel.org/stable/c/b2c1e5d9f1598cc1a4736d5c6bd1218f90805ee4
- https://git.kernel.org/stable/c/b5daa920f44cb582272fc9bfaeb67408776cbaef
- https://git.kernel.org/stable/c/c55da494dfb445fb28df3a9d293c2be6a299cd01