Executive brief
A vulnerability in the Linux kernel's Thunderbolt driver could allow for an out-of-bounds memory read. This occurs when the system processes specially crafted Thunderbolt device properties, potentially leading to system instability or information disclosure. Users are advised to update their Linux kernel to a patched version.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel Thunderbolt driver's __tb_property_parse_dir() function. The function fails to validate that the sum of content_offset and content_len remains within the allocated block_len for root directory structures. When a root directory's length exceeds the block size minus two, the subsequent entry loop reads past the allocated property block. This can be triggered by malformed Thunderbolt XDomain properties. Patches have been released for multiple stable kernel branches including 5.10.y, 5.15.y, 6.1.y, and others.
Affected products
- Linux Linux Kernel 4.15 to 6.13
Timeline
- 2026-06-25: disclosed: CVE published by kernel.org and NVD
- 2026-06-19: patched: Fix committed to stable kernel trees by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/0a32040a48db8cf35de48b85d6115df5623e4964
- https://git.kernel.org/stable/c/1912be23daf4afc8d24ce916021ab68ca4c679db
- https://git.kernel.org/stable/c/4d0b1524caadb04c10a71f3f88692c63dcb39115
- https://git.kernel.org/stable/c/5c7657d38d07268124782f03519f07c22a5814fb
- https://git.kernel.org/stable/c/60ba6217460792356a238299edd675d91d46bab4
- https://git.kernel.org/stable/c/65423079c7420e3dbf9a7aa345c243a3f5752e5d
- https://git.kernel.org/stable/c/b212bc161d8a9937b42153723a4a3f2f74fab528