CVE-2026-74585: thunderbolt: Bound the DROM dual link port number before indexing sw->ports
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
tbdromparseentryport() validates the device-supplied header->index against sw->config.maxportnumber before indexing sw->ports[], but the sibling field entry->duallinkportnr -- a 6-bit value also read from the DROM -- indexes the same array with no such check. A malicious or malformed Thunderbolt device can set duallinkportnr beyond the allocated sw->ports[] (maxportnumber + 1 entries), producing an out-of-bounds tbport pointer that is stored and later dereferenced.
Reject a port entry whose duallinkportnr exceeds maxportnumber, the same bound already applied to header->index.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to trigger this issue?
The attacker needs to provide a malicious or malformed Thunderbolt device whose DROM port entry contains a dual_link_port_nr value greater than the switch's configured maximum port number.
Which systems are exposed?
Systems that parse DROM data from attached Thunderbolt devices are relevant, because the vulnerable path reads the device-supplied dual_link_port_nr and uses it to index the switch port array.
What is the consequence of a malformed dual-link port number?
An out-of-range value can produce an out-of-bounds tb_port pointer that is stored and later dereferenced.
What does the resolved fix change?
The fix rejects a port entry when dual_link_port_nr exceeds max_port_number, matching the existing bound check applied to the entry header index.