Executive brief
The Linux kernel's Thunderbolt networking driver fails to properly validate the number of frames in incoming network packets, allowing an attacker to overflow an internal buffer and corrupt kernel memory. This could lead to system crashes or remote code execution on systems with Thunderbolt networking enabled.
Technical details
The vulnerability exists in the Thunderbolt networking driver's packet reassembly logic (tbnet_poll and tbnet_check_frame functions). When reassembling multi-frame packets, the first frame is placed in the socket buffer's linear area while subsequent frames are added as page fragments. The driver only validated frame counts up to 64 (TBNET_RING_SIZE / 4), but the socket buffer structure can only hold 17 fragments (MAX_SKB_FRAGS). A remote peer sending 19+ small frames causes the code to write past the end of the frags[] array, corrupting adjacent kernel memory. The fix tightens the frame count validation to MAX_SKB_FRAGS + 1. This is a remote network-based attack requiring no authentication or user interaction—any peer on a Thunderbolt network connection can trigger it.
Affected products
- Linux Linux kernel affected versions prior to the fix (commit 55d9895f8997)
Timeline
- 2026-08-15: disclosed: CVE-2026-72157 published
- 2026-06-18: patched: Upstream fix committed (55d9895f89970501fe126d1026b586b04a224c27)
- 2026-07-24: patched: Stable kernel backport committed (2b3b4e5ff5a58ad32817824b0310e63908b12052)