Executive brief
A vulnerability in the Linux kernel's Thunderbolt driver could allow a malicious device or local user to crash the system. By providing specially crafted device property data, an attacker can trigger memory errors that lead to a system 'oops' or kernel panic. This primarily impacts the availability of the affected machine.
Technical details
A vulnerability exists in the __tb_property_parse_dir() function within drivers/thunderbolt/property.c of the Linux kernel. When processing non-root property directories, the code fails to validate that the directory length (dir_len) is at least 4. This leads to two issues: an out-of-bounds read during UUID copying via kmemdup(), and a size_t underflow when calculating content_len (dir_len - 4). The underflow results in a massive nentries value, causing the subsequent loop to perform out-of-bounds reads until the kernel encounters an unmapped page and crashes. The fix involves rejecting dir_len < 4 and ensuring proper list initialization before error returns.
Affected products
- Linux Linux kernel cdae7c07e3e3509eaabc18c1640a55dc5b99c179
Timeline
- 2026-05-10: other: Vulnerability fixed in source code
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/37abc4504fa19d8f9f1e87792e8a2b8fdb308e40
- https://git.kernel.org/stable/c/3bec49ca55e08fb085cc4318f24b1b37eaab28cb
- https://git.kernel.org/stable/c/542a13890b742099c461d70920e97b14e568f6ec
- https://git.kernel.org/stable/c/5506c825f14d810f0690b1f4367cb7249ebb387a
- https://git.kernel.org/stable/c/d548179adcc87e1bc66b17e00352a1f536e76065
- https://git.kernel.org/stable/c/de21b59c29e31c5108ddc04210631bbfab81b997
- https://git.kernel.org/stable/c/de618299190b418291609e6921557253bd417e25