CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count
In the Linux kernel, the following vulnerability has been resolved:
net: thunderbolt: Fix frags[] overflow by bounding framecount
tbnetpoll() assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment.
skbaddrxfrag(skb, skbshinfo(skb)->nrfrags, page, hdrsize, framesize, TBNETRXPAGESIZE - hdrsize);
A packet of framecount frames therefore ends up with framecount - 1 fragments. tbnetcheckframe() only bounds the peer supplied framecount to TBNETRINGSIZE / 4 (64), which is far above MAXSKBFRAGS (17 by default). A peer that sends a packet of 19 or more small frames pushes nrfrags past MAXSKBFRAGS, so skbaddrxfrag() writes past skbshinfo()->frags[] and corrupts memory after the shared info.
Tighten the start of packet bound to MAXSKBFRAGS + 1 so a packet can never produce more fragments than frags[] can hold. This matches the recent skb frags overflow fixes in other receive paths, for example f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path") and 600dc40554dc ("net: usb: cdc-phonet: fix skb frags[] overflow in rxcomplete()").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (net: usb: cdc-phonet)to a version that resolves this vulnerability.Patch f0813bcd2d9d - Upgrade
Upgrade
Linux kernel (net: thunderbolt)to a version that resolves this vulnerability.Patch 600dc40554dc - Upgrade
Upgrade
Linux kernel (wwan: t7xx)to a version that resolves this vulnerability.Patch 600dc40554dc - Compensating control
After applying the kernel fix, ensure test/monitoring covers receive-path skb fragment handling so malformed packets from peers that could trigger skb_shinfo()->frags[] overflows are detected and limited/filtered at the network boundary.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72157?
The severity of CVE-2026-72157 is rated at 71.
How do I fix CVE-2026-72157?
To fix CVE-2026-72157, update to the latest version of the Linux kernel where the vulnerability has been patched.
What are the potential impacts of CVE-2026-72157?
The potential impacts of CVE-2026-72157 include overflow issues that could lead to unexpected behavior or crashes in the affected systems.
Is CVE-2026-72157 exploitable remotely?
CVE-2026-72157 may be exploited remotely if the affected service is exposed to untrusted networks.
What software is affected by CVE-2026-72157?
CVE-2026-72157 affects the Linux kernel, specifically the Thunderbolt IP implementation.