CVE-2026-74585thunderbolt: Bound the DROM dual link port number before indexing sw->ports
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound the DROM dual link port number before indexing sw->ports tb_drom_parse_entry_port() validates the device-supplied header->index against sw->config.max_port_number before indexing sw->ports[], but the sibling field entry->dual_link_port_nr -- a 6-bit value also read from the DROM -- indexes the same array with no such check. A malicious or malformed Thunderbolt device can set dual_link_port_nr beyond the allocated sw->ports[] (max_port_number + 1 entries), producing an out-of-bounds tb_port pointer that is stored and later dereferenced. Reject a port entry whose dual_link_port_nr exceeds max_port_number, the same bound already applied to header->index.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 22, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 before 6c892ed9f4129ae40ef0f92e1bb31aa0b0ddc72c; from cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 before 3d3c212b70633332ab71672aa2bc6af257d2ec83; from cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 before b98e1e28bd95b0fa33164eec1e763d26c7058b39; from cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 before 50f0c8dd8c3390f851cfb97ca13116f9ee6469d1; from cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 before f28066057134aa9294caa597b670daf505ad9dce; from cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 before 40d2ffb74094cf36edbe05855566a4c58b6ce808; from cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 before f32c3a9a77cfb50934a60b05d5407649af062535; from cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 before d6764992f17b23d91ff93ce905ab53c2aa7191f0 | CNA record |
References
- https://git.kernel.org/stable/c/6c892ed9f4129ae40ef0f92e1bb31aa0b0ddc72c
- https://git.kernel.org/stable/c/3d3c212b70633332ab71672aa2bc6af257d2ec83
- https://git.kernel.org/stable/c/b98e1e28bd95b0fa33164eec1e763d26c7058b39
- https://git.kernel.org/stable/c/50f0c8dd8c3390f851cfb97ca13116f9ee6469d1
- https://git.kernel.org/stable/c/f28066057134aa9294caa597b670daf505ad9dce
- https://git.kernel.org/stable/c/40d2ffb74094cf36edbe05855566a4c58b6ce808
- https://git.kernel.org/stable/c/f32c3a9a77cfb50934a60b05d5407649af062535
- https://git.kernel.org/stable/c/d6764992f17b23d91ff93ce905ab53c2aa7191f0
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.