Executive brief
A vulnerability in the Linux kernel's Thunderbolt driver could allow a malicious device, such as a dock or cable, to crash the system. By sending specially crafted data during the initial connection process, an attacker can cause the kernel to run out of memory and stop functioning. This issue can be triggered by any untrusted device physically connected to the system without requiring any user login or authentication.
Technical details
The vulnerability exists in the __tb_property_parse_dir() function within the Thunderbolt driver (drivers/thunderbolt/property.c). The parser fails to implement a recursion depth limit when processing DIRECTORY entries, allowing a crafted peer to provide a back-reference loop that leads to kernel stack exhaustion. An attacker with physical access or an untrusted XDomain peer (e.g., a malicious cable or dock) can trigger this during the PROPERTIES_REQUEST control-plane exchange. The fix introduces a depth counter and enforces a maximum recursion limit of 8. As a workaround, users can disable XDomain discovery by setting thunderbolt.xdomain=0 in the kernel command line.
Affected products
- Linux Linux kernel cdae7c07e3e3509eaabc18c1640a55dc5b99c179 to 928abe19fbf0127003abcb1ea69cabc1c897d0ab
Timeline
- 2026-06-05: other: Vulnerability fixed in source code
- 2026-07-19: advisory: CVE published
References
- https://git.kernel.org/stable/c/0a84ab9271936c11e84e511bb52fc5682f8b6726
- https://git.kernel.org/stable/c/2b5f47a710172c962ef42d1b732b04d2ad0dce21
- https://git.kernel.org/stable/c/830c8a9b467e7d3a158483d37fa7dc13892b293a
- https://git.kernel.org/stable/c/928abe19fbf0127003abcb1ea69cabc1c897d0ab
- https://git.kernel.org/stable/c/95839a67ea56ca35732aad7f711404a3127cfe2d
- https://git.kernel.org/stable/c/b4621e5ef63405c317a84b711faf3bd75b3c6a94
- https://git.kernel.org/stable/c/ed9455ef4bd9babc90f92e526abe3fb68c1a8709