SB20260816371 - Out-of-bounds write in Linux kernel net thunderbolt driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-72157)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to an out-of-bounds write in tbnet_poll() when processing a multi-frame ThunderboltIP packet with a peer-supplied frame_count that exceeds the fragment array capacity. A remote attacker can send a specially crafted packet with 19 or more small frames to corrupt memory.

The issue occurs because the first frame is placed in the skb linear area while subsequent frames are added as page fragments.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2b3b4e5ff5a58ad32817824b0310e63908b12052
• https://git.kernel.org/stable/c/55d9895f89970501fe126d1026b586b04a224c27
• https://git.kernel.org/stable/c/e27beb4536cbf1d59e2d8c2840e87d972aba906f
• https://git.kernel.org/stable/c/e5824d5b841d99a2bcdd4e2c256643293bbc22c1
• https://git.kernel.org/stable/c/fe6b606fbf0c3beb94ccf17fcf31d8c2138264e3