CVE-2026-72157 - Vulnerability Details

- net: thunderbolt: Fix frags[] overflow by bounding frame_count

Description

In the Linux kernel, the following vulnerability has been resolved:

net: thunderbolt: Fix frags[] overflow by bounding frame_count

tbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The
first frame goes into the skb linear area and every further frame is added as
a page fragment.

skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
page, hdr_size, frame_size,
TBNET_RX_PAGE_SIZE - hdr_size);

A packet of frame_count frames therefore ends up with frame_count - 1
fragments. tbnet_check_frame() only bounds the peer supplied frame_count to
TBNET_RING_SIZE / 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A
peer that sends a packet of 19 or more small frames pushes nr_frags past
MAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and
corrupts memory after the shared info.

Tighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never
produce more fragments than frags[] can hold. This matches the recent skb
frags overflow fixes in other receive paths, for example f0813bcd2d9d ("net:
wwan: t7xx: fix potential skb->frags overflow in RX path") and 600dc40554dc
("net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()").

Published: 2026-08-15

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel Thunderbolt IP driver contains a buffer overflow: a peer can send a packet with more frames than the skb can hold, causing tbnet_poll() to write past skb_shinfo()->frags[], corrupting memory after the shared info structure. This out-of-bounds write can overwrite critical kernel data and gives an attacker the ability to execute arbitrary code with kernel privileges, a flaw classified as CWE-787.

Affected Systems

All Linux kernel installations that have not incorporated the commit bounding frame_count to MAX_SKB_FRAGS+1 are vulnerable. No specific distribution or kernel version details are provided, but any kernel lacking the patch is impacted.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity while the EPSS score of <1% shows a currently low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. Exploitation would require a malicious peer device that can transmit a crafted Thunderbolt packet, meaning the attacker must have physical or at least local access to the Thunderbolt interface. When successfully exploited, the out-of-bounds write can overwrite kernel memory and allow arbitrary code execution at ring 0.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e`	affected	< f96b3b35c622d565eff2438993e028d280163f5c
`e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e`	affected	< 6262f51e09d8dc8b07599a9e4f03bd3989d13fff
`e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e`	affected	< 569ba39b2d12995a29dc158e5b4de6e449278f30
`e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e`	affected	< 2b3b4e5ff5a58ad32817824b0310e63908b12052
`e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e`	affected	< e27beb4536cbf1d59e2d8c2840e87d972aba906f
`e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e`	affected	< e5824d5b841d99a2bcdd4e2c256643293bbc22c1
`e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e`	affected	< fe6b606fbf0c3beb94ccf17fcf31d8c2138264e3
`e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e`	affected	< 55d9895f89970501fe126d1026b586b04a224c27

Linux

affected

Version	Status	Constraints
`4.15`	affected	—
`0`	unaffected	< 4.15
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e,2b3b4e5ff5a58ad32817824b0310e63908b12052)`	affected	code_commit	—
`[e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e,e27beb4536cbf1d59e2d8c2840e87d972aba906f)`	affected	code_commit	—
`[e69b6c02b4c3b8d03be7136f90dd9551ad5a5e,e5824d5b841d99a2bcdd4e2c256643293bbc22c1)`	affected	code_commit	—
`[e69b6c02b4c3b8d03be7136f90dd9551ad5a5e,fe6b606fbf0c3beb94ccf17fcf31d8c2138264e3)`	affected	code_commit	—
`[e69b6c02b4c3b8d03be7136f90dd9551ad5a5e,55d9895f89970501fe126d1026b586b04a224c27)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.15`	affected	generic	—
`[0,4.15)`	unaffected	generic	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the patch commit setting frame_count to MAX_SKB_FRAGS+1
If an update is delayed, disable the Thunderbolt IP driver or block untrusted Thunderbolt devices by configuring the system to ignore Thunderbolt traffic
Enable kernel logging for skb fragment overrun errors and monitor for suspicious activity

Generated by OpenCVE AI on August 22, 2026 at 10:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00345.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2b3b4e5ff5a58ad32817824b0310e63908b12052
https://git.kernel.org/stable/c/55d9895f89970501fe126d1026b586b04a224c27
https://git.kernel.org/stable/c/569ba39b2d12995a29dc158e5b4de6e449278f30
https://git.kernel.org/stable/c/6262f51e09d8dc8b07599a9e4f03bd3989d13fff
https://git.kernel.org/stable/c/e27beb4536cbf1d59e2d8c2840e87d972aba906f
https://git.kernel.org/stable/c/e5824d5b841d99a2bcdd4e2c256643293bbc22c1
https://git.kernel.org/stable/c/f96b3b35c622d565eff2438993e028d280163f5c
https://git.kernel.org/stable/c/fe6b606fbf0c3beb94ccf17fcf31d8c2138264e3
https://lore.kernel.org/linux-cve-announce/2026081535-CVE-2026-72157-0426@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72157
https://www.cve.org/CVERecord?id=CVE-2026-72157

History

Sun, 23 Aug 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/569ba39b2d12995a29dc158e5b4de6e449278f30 https://git.kernel.org/stable/c/6262f51e09d8dc8b07599a9e4f03bd3989d13fff https://git.kernel.org/stable/c/f96b3b35c622d565eff2438993e028d280163f5c

Wed, 19 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://lore.kernel.org/linux-cve-announce/2026081535-CVE-2026-72157-0426@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72157 https://www.cve.org/CVERecord?id=CVE-2026-72157
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags[] overflow by bounding frame_count tbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment. skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, hdr_size, frame_size, TBNET_RX_PAGE_SIZE - hdr_size); A packet of frame_count frames therefore ends up with frame_count - 1 fragments. tbnet_check_frame() only bounds the peer supplied frame_count to TBNET_RING_SIZE / 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A peer that sends a packet of 19 or more small frames pushes nr_frags past MAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and corrupts memory after the shared info. Tighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never produce more fragments than frags[] can hold. This matches the recent skb frags overflow fixes in other receive paths, for example f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path") and 600dc40554dc ("net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()").
Title		net: thunderbolt: Fix frags[] overflow by bounding frame_count
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2b3b4e5ff5a58ad32817824b0310e63908b12052 https://git.kernel.org/stable/c/55d9895f89970501fe126d1026b586b04a224c27 https://git.kernel.org/stable/c/e27beb4536cbf1d59e2d8c2840e87d972aba906f https://git.kernel.org/stable/c/e5824d5b841d99a2bcdd4e2c256643293bbc22c1 https://git.kernel.org/stable/c/fe6b606fbf0c3beb94ccf17fcf31d8c2138264e3

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:53:26.718Z

Updated: 2026-08-23T12:46:55.998Z

Reserved: 2026-08-09T03:40:39.909Z

Link: CVE-2026-72157

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:33.497

Modified: 2026-08-23T13:16:40.970

Link: CVE-2026-72157

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72157 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T10:45:03Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object