CVE-2026-74585

A flaw was found in the Linux kernel's Thunderbolt driver. A malicious or malformed Thunderbolt device can provide an invalid port number, leading to an out-of-bounds memory access. This can result in memory corruption and potentially lead to a denial of service or other unspecified impacts.

A malicious or malformed Thunderbolt device can provide a DROM port entry where dual_link_port_nr is larger than the allocated sw ports array. The unchecked value is used to build an out-of-bounds tb_port pointer and that pointer can be stored and later dereferenced by the Thunderbolt driver. This is a physical attack surface, not a network reachable issue. For the CVSS the PR:N is used because the attacker does not need local credentials on the victim system and only needs the ability to present a crafted Thunderbolt device. Impact is at least denial of service via kernel crash and may include confidentiality or integrity impact because the bug creates an out-of-bounds kernel object pointer that can be used after parsing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.