Executive brief
A vulnerability in the Linux kernel's Thunderbolt driver could allow a malicious connected device to access sensitive information from the computer's memory. By sending specially crafted data, an attacker can bypass security checks to read memory outside of the intended area. This could lead to the exposure of system details like device and vendor identifiers that are normally protected.
Technical details
An integer overflow exists in the tb_property_entry_valid() function within the Thunderbolt driver (drivers/thunderbolt/property.c). The vulnerability occurs because the sum of entry->value (u32) and entry->length (u16) is performed as a 32-bit operation without overflow checking. A malicious XDomain peer can provide values that cause the sum to wrap around to zero, bypassing the block_len boundary check. This allows tb_property_parse() to use the overflowed value as an offset to read memory far beyond the intended allocation. For certain entry types (deviceid/vendorid), the leaked data is copied into xd->device_name or xd->vendor_name and can be read by local users via sysfs. The fix implements check_add_overflow() to properly validate the sum.
Affected products
- Linux Linux kernel cdae7c07e3e3 to 01deda015206
Timeline
- 2026-05-10: other: Vulnerability fixed in source code
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/01deda0152066c6c955f0619114ea6afa070aaec
- https://git.kernel.org/stable/c/31b98e503ecca8077e5247253dd5425ab84bc96d
- https://git.kernel.org/stable/c/5c06a3043ad944f087bb2ae0aae28d820bb9f460
- https://git.kernel.org/stable/c/6a63623621639acbb39bc2d9fb09559681716695
- https://git.kernel.org/stable/c/8d4a758b407ab3de3be86d1ceadfa35d717d30c7
- https://git.kernel.org/stable/c/9fee50c4e1e42f6d3cbe30df584f9f648f626071
- https://git.kernel.org/stable/c/a47784aee77f33f786dc5d7375db821bdae68792