CVE-2026-72157

Received Received - Intake

Buffer Overflow in Linux Kernel Thunderbolt Networking

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags[] overflow by bounding frame_count tbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment. skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, hdr_size, frame_size, TBNET_RX_PAGE_SIZE - hdr_size); A packet of frame_count frames therefore ends up with frame_count - 1 fragments. tbnet_check_frame() only bounds the peer supplied frame_count to TBNET_RING_SIZE / 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A peer that sends a packet of 19 or more small frames pushes nr_frags past MAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and corrupts memory after the shared info. Tighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never produce more fragments than frags[] can hold. This matches the recent skb frags overflow fixes in other receive paths, for example f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path") and 600dc40554dc ("net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()").

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72157

EUVD

EUVD-2026-58915

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory corruption issue in the Thunderbolt networking subsystem. When processing multi-frame ThunderboltIP packets, the code incorrectly allows the number of frame fragments to exceed the maximum allowed by the kernel's skb structure. This leads to writing beyond the allocated memory for fragments, potentially causing system instability or crashes.

Detection Guidance

This vulnerability involves a kernel memory corruption issue in Thunderbolt networking. Detection requires checking kernel logs for related errors or monitoring network interfaces for unusual packet fragmentation behavior. Look for messages like 'skb_shinfo(skb)->nr_frags' overflows or memory corruption warnings in dmesg output. Commands to check include 'dmesg | grep -i thunderbolt' and 'dmesg | grep -i frags'.

Impact Analysis

If exploited, this vulnerability could allow an attacker on the same network segment to cause a denial of service by crashing the affected system. It may also potentially enable further malicious activities depending on the system's configuration and the attacker's goals.

Compliance Impact

This vulnerability is a memory corruption issue in the Linux kernel's Thunderbolt networking subsystem. It does not directly relate to data privacy, access control, or audit logging requirements typically addressed by GDPR or HIPAA. Compliance impact would depend on whether the affected system processes sensitive data, but the vulnerability itself is not a direct violation of these standards.

Mitigation Strategies

Immediate mitigation requires updating the Linux kernel to a patched version that includes the fix for this Thunderbolt networking vulnerability. Check your distribution's security updates and apply them immediately. If updating is not immediately possible, consider disabling Thunderbolt networking functionality as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-72157. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70