Executive brief
A vulnerability in the Linux kernel's Thunderbolt driver could allow a local attacker to cause a system crash. The issue occurs when the system processes specifically malformed Thunderbolt device properties, leading to an invalid memory write. This primarily impacts system stability and availability for devices using Thunderbolt or XDomain connections.
Technical details
An integer underflow exists in the Thunderbolt driver's property validator, specifically within the tb_property_entry_valid() function in drivers/thunderbolt/property.c. The validator incorrectly accepts entries with a length of zero for DIRECTORY, DATA, and TEXT types. For TEXT types, this leads to an underflow in the null-termination logic where 'property->length * 4 - 1' results in a write to offset -1 relative to the allocated buffer. An attacker with the ability to provide XDomain property blocks could exploit this to cause a kernel memory corruption or system crash. The issue has been resolved by explicitly rejecting zero-length entries in the validator.
Affected products
- Linux Linux Kernel 4.15 to 6.13.y
Timeline
- 2026-05-25: other: Patch authored
- 2026-06-19: patched: Patch committed to stable tree
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2e0ddac549ebd713eb9f4a15b6496e3440a17d8b
- https://git.kernel.org/stable/c/35d6c9252a152e756768a26dbf216b9dd9dd8e92
- https://git.kernel.org/stable/c/3b6e68cb97f725385010264a873e14a3921b6b8a
- https://git.kernel.org/stable/c/581c2053ab4dbe27e83c9e62deb4c73aa8dc0c3a
- https://git.kernel.org/stable/c/5f56bc6bddffe8710ba0ba8844023b5a44ca90e4
- https://git.kernel.org/stable/c/99d9dbad1463afb510d42c9714f846361d1b726d
- https://git.kernel.org/stable/c/ca11e7da4fba4b394f69e16448f4463c44c84de6