CVE-2026-72157

A flaw was found in the Linux kernel's Thunderbolt network driver. A remote attacker could send specially crafted ThunderboltIP packets with an excessive number of frames. This could lead to an overflow in the frags[] array, causing memory corruption after the shared information buffer. This vulnerability allows an attacker to potentially compromise the system's integrity.

This vulnerability is evaluated as Moderate severity because exploitation requires an adjacent or directly attached peer communicating over an active ThunderboltIP interface. In standard Red Hat Enterprise Linux enterprise and cloud deployments, Thunderbolt networking is uncommon and not enabled by default. As the attack vector cannot be triggered across general routed IP networks, overall exposure is substantially limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.