CVE-2026-80736

A flaw was found in the Linux kernel's Thunderbolt driver. The tbconsumeddpbandwidth function attempts to access an array beyond its allocated memory, specifically when handling bandwidth group IDs. This out-of-bounds read can lead to an incorrect calculation of reserved bandwidth for Thunderbolt...

CVE-2026-98896

A flaw was found in the Linux kernel's Thunderbolt driver. A race condition can occur when a device hotplug event is processed concurrently with driver removal, resulting in a use-after-free condition where freed memory is accessed. A local user could exploit this flaw to cause a Denial of Servic...

CVE-2026-98694

A flaw was found in the Linux kernel's Thunderbolt driver. When a control channel request is canceled, a race condition can cause the request to be rescheduled after its memory has already been freed, resulting in a use-after-free vulnerability. A local attacker could exploit this flaw to cause a...

CVE-2026-98693

A flaw was found in the Linux kernel's Thunderbolt driver. A physically proximate user or local attacker could trigger a Denial of Service DoS and crash the system by disconnecting a device or unbinding the driver while DisplayPort tunnel operations are still active. This issue occurs because the...

CVE-2026-98687

A flaw was found in the Linux kernel's Thunderbolt driver. When processing property requests from peer devices, the driver fails to verify that the response data length does not exceed the allocated buffer size. A malicious peer can exploit this flaw by sending an oversized response packet,...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.15 contains a security vulnerability. This vulnerability arises from the thunderbolt driver not restricting the length of XDomain response data. Malicious peers can set the length field to 63, causing the driver to process data in 48-byte chunks and exceeding the...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.14 contains a security vulnerability. This vulnerability arises from the thunderbolt driver failing to release the domain reference acquired by tbtunnelonedp when DP RX reading is canceled. When the operation is cancelled, the reference leaks, potentially leading to a...

Linux Kernel Security Vulnerabilities

The Linux kernel versions 5.10.266 to 5.11, 5.15.217 to 5.16, and 7.2 contain security vulnerabilities. These vulnerabilities stem from a race condition between the tbremovework and tbdomainremove functions in the Thunderbolt driver. The tbfreeunpluggedxdomains function is called without checking...

ROS-20261012-73-0108

The vulnerability of the tbpropertyparsedir function in the drivers/thunderbolt/property.c module of the general support for USB4 and Thunderbolt driver in the Linux operating system is related to the execution of operations outside of the buffer. Exploiting this vulnerability could allow an...

ROS-20261008-73-0224

The vulnerability of the tbpropertyparsedir function in the drivers/thunderbolt/property.c module of the general support for USB4 and Thunderbolt driver in the Linux kernel is related to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability could allow an...

ROS-20260922-73-0096

The vulnerability of the tbxdppropertiesrequest function in the drivers/thunderbolt/xdomain.c file of the general support driver for USB4 and Thunderbolt in the Linux operating system is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could...

CVE-2026-89737

A flaw was found in the Linux kernel's USB Type-C Thunderbolt driver. The tbtaltmoderemove function fails to properly disable and drain work items before freeing associated plug and cable references. This oversight can lead to a use-after-free vulnerability, where the system attempts to access...

AZL-100662 CVE-2026-80990 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Release the Rx HopID that was handed out on mismatch tbxdomainallocinhopid passes the wanted HopID to idaallocrange as the lower bound, so a taken id is not an error there: the allocator returns the next free on...

CVE-2026-80990

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Release the Rx HopID that was handed out on mismatch tbxdomainallocinhopid passes the wanted HopID to idaallocrange as the lower bound, so a taken id is not an error there: the allocator returns the next free on...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.13. It stems from the thunderbolt driver failing to release allocated IDs when Rx HopID mismatches occur, potentially leading to resource leaks...

USB4 Thunderbolt DoS

The vulnerability in the tbpropertyparsedir function within drivers/thunderbolt/property.c of the USB4 and Thunderbolt general support driver for the Linux kernel is related to buffer overflow. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

USB4 Thunderbolt Driver Heap Buffer Overflow DoS

The vulnerability in the formatdwdata function within drivers/thunderbolt/property.c of the USB4 and Thunderbolt support driver for the Linux kernel is related to buffer overflow. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information or cause a...

Linux kernel USB4 Thunderbolt tb_xdp_properties_request() Buffer Overflow DoS

The vulnerability in the tbxdppropertiesrequest function within drivers/thunderbolt/xdomain.c of the USB4 and Thunderbolt general support driver for the Linux kernel is related to a buffer overflow in memory. Exploitation of this vulnerability could allow an attacker to compromise the...

CVE-2026-74585

A flaw was found in the Linux kernel's Thunderbolt driver. A malicious or malformed Thunderbolt device can provide an invalid port number, leading to an out-of-bounds memory access. This can result in memory corruption and potentially lead to a denial of service or other unspecified impacts...

SUSE CVE-2026-74691

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Tear down DMA paths before stopping the rings tbnetteardown stops both rings and frees their frame buffers before calling tbxdomaindisablepaths. tbringstop zeroes the ring's descriptor base and tbnetfreebuffers...