Executive brief
A vulnerability in the Linux kernel's Thunderbolt driver could allow a malicious device connected via Thunderbolt to crash the system or potentially execute unauthorized code. The issue occurs when the system requests property information from a connected device and fails to verify that the device's response fits within the expected memory area. This could lead to a system instability or a security breach if an attacker has physical access to plug in a specially crafted device.
Technical details
A heap buffer overflow exists in the `tb_xdp_properties_request()` function within `drivers/thunderbolt/xdomain.c`. The function derives a per-packet copy length from a response header provided by a Thunderbolt peer without validating it against the `data_len` of the `kcalloc` allocated buffer. An attacker controlling a Thunderbolt-connected device can specify a length larger than the allocated space, causing `memcpy` to write past the buffer boundaries. The fix introduces clamping of the copy length to ensure the cumulative offset never exceeds the allocated buffer size. This vulnerability requires a malicious device to be connected to the Thunderbolt port.
Affected products
- Linux Linux Kernel 4.15 to 6.1.176
Timeline
- 2026-05-25: other: Patch authored
- 2026-06-25: advisory: CVE published
References
- https://git.kernel.org/stable/c/05a43157676c243c248d1c6d9dcecbe6eba2f35d
- https://git.kernel.org/stable/c/0b334279a82d79fb4723bd4f614305de1ab69caa
- https://git.kernel.org/stable/c/322e93448d908434ae5545660fcbe8f5a7a8e141
- https://git.kernel.org/stable/c/5db10c8ad8c09f72c847dfeef3d876098257f505
- https://git.kernel.org/stable/c/6021d39ccd979713b39b980286020d8f9a45efd1
- https://git.kernel.org/stable/c/89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d
- https://git.kernel.org/stable/c/906035d5c3784570191d259cbf9a0ac1617852b5