Linux kernel ThunderboltIP frags[] array overflow in tbnet_poll()
The Linux kernel ThunderboltIP driver overflows the skb frags[] array when assembling packets with more than 18 frames, enabling heap corruption by a malicious Thunderbolt peer.
- Vendor
- Linux Kernel
- Product
- Linux kernel (ThunderboltIP / tbnet driver)
- CVSS
- N/A
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
tbnet_poll() assembles multi-frame ThunderboltIP packets by calling skb_add_rx_frag() for each frame beyond the first. The loop ran up to frame_count - 1 times without checking skb_shinfo(skb)->nr_frags against MAX_SKB_FRAGS (17 on x86). A peer sending a packet claiming more than 18 frames overflowed the frags[] array, corrupting kernel heap memory adjacent to the skb structure.
ThunderboltIP provides IP-over-Thunderbolt networking for direct device-to-device connections. Attack prerequisite is a malicious or compromised device connected via Thunderbolt — physical access or supply-chain compromise of an attached dock or device. Not remotely exploitable over the internet.
The patch adds a frame_count upper-bound check before the loop begins, capping nr_frags usage below MAX_SKB_FRAGS. No CVSS score has been assigned by NVD as of publication. No exploitation in the wild confirmed. Update to the current Linux stable release.
Source: kernel.org stable commit. Published on NVD 2026-08-15.
