Executive brief
The Linux kernel's Thunderbolt driver processes configuration data from devices. A malicious or malformed Thunderbolt device can provide crafted DROM data that causes an out-of-bounds array access when the driver attempts to store a pointer to a port that doesn't exist, potentially leading to a system crash or privilege escalation if the out-of-bounds memory is leveraged.
Technical details
The vulnerability is an out-of-bounds array indexing flaw in the Thunderbolt driver's DROM parsing code (drivers/thunderbolt/eeprom.c). The function tb_drom_parse_entry_port() validates the header->index field against max_port_number before indexing sw->ports[], but fails to validate the dual_link_port_nr field (a 6-bit value) which is also read from the device-supplied DROM. A malicious device can set dual_link_port_nr to exceed max_port_number, causing out-of-bounds access to the sw->ports[] array. This produces an out-of-bounds pointer that is stored and later dereferenced, potentially causing a denial of service or memory corruption. The fix adds a bounds check on dual_link_port_nr matching the validation applied to header->index, rejecting any port entry where dual_link_port_nr exceeds max_port_number. This is a local/adjacent attack requiring a malicious Thunderbolt device to be physically connected.
Affected products
- Linux Linux kernel
Timeline
- 2026-08-22: disclosed
- 2026-08-19: patched: Fix committed upstream