CVE-2026-74585: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74585 Overview

CVE-2026-74585 is an out-of-bounds read vulnerability in the Linux kernel's Thunderbolt subsystem. The flaw resides in tb_drom_parse_entry_port(), which parses Device ROM (DROM) entries provided by attached Thunderbolt devices. While the function validates the header->index field against sw->config.max_port_number, the sibling field entry->dual_link_port_nr — a 6-bit value read from the same DROM — indexes sw->ports[] without a bounds check. A malicious or malformed Thunderbolt device can set dual_link_port_nr beyond the allocated sw->ports[] array, producing an out-of-bounds tb_port pointer that the kernel stores and later dereferences.

Critical Impact
A malicious Thunderbolt device can trigger an out-of-bounds pointer dereference in the Linux kernel, potentially causing memory corruption or a kernel crash on a system with a physically connected attacker-controlled peripheral.

Affected Products

Linux kernel Thunderbolt subsystem (drivers/thunderbolt/)
Multiple stable kernel branches receiving backported fixes across eight commits
Systems exposing Thunderbolt ports to untrusted physical devices

Discovery Timeline

2026-08-22 - CVE-2026-74585 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74585

Vulnerability Analysis

The Thunderbolt driver builds an internal representation of a device's ports based on the DROM data structure supplied by the peripheral. Each port entry contains an index field describing the primary port number and a dual_link_port_nr field describing the sibling port that forms the dual-link pair. The kernel allocates sw->ports[] with max_port_number + 1 entries and validates header->index against this bound before indexing.

The dual_link_port_nr field, however, is used to index the same sw->ports[] array with no equivalent validation. Because the value is device-controlled and occupies 6 bits, it can reach 63 while the allocated array is typically much smaller. The resulting out-of-bounds pointer is stored inside the port structure and later dereferenced during subsequent Thunderbolt topology operations.

The fix rejects any port entry whose dual_link_port_nr exceeds max_port_number, applying the same bound already enforced on header->index. Patches have been merged across multiple stable branches, including commits 3d3c212, 40d2ffb, 50f0c8d, 6c892ed, b98e1e2, d676499, f280660, and f32c3a9.

Root Cause

The root cause is missing input validation on attacker-controlled DROM data. The dual_link_port_nr field is trusted implicitly, while the neighboring index field is validated. This inconsistent bounds checking leads to an out-of-bounds array indexing condition classified as an Out-of-Bounds Read.

Attack Vector

Exploitation requires physical access. An attacker connects a malicious or malformed Thunderbolt peripheral that presents a crafted DROM containing a dual_link_port_nr value greater than the device's real max_port_number. When the kernel enumerates the device, the driver stores an out-of-bounds tb_port pointer. Later dereference of that pointer can result in kernel memory disclosure, memory corruption, or a system crash.

No exploitation code has been described in the enriched data. See the kernel patch 3d3c212 for the specific validation added to tb_drom_parse_entry_port().

Detection Methods for CVE-2026-74585

Indicators of Compromise

Unexpected kernel oops or page-fault traces referencing tb_drom_parse_entry_port or thunderbolt symbols in dmesg or /var/log/kern.log.
Thunderbolt device enumeration events for peripherals with unusual or unknown vendor IDs on endpoints that do not routinely use Thunderbolt docks.
Kernel panics correlated with a physical device insertion event on ports exposing PCIe over Thunderbolt.

Detection Strategies

Monitor kernel logs for Thunderbolt subsystem errors, particularly warnings or faults tied to DROM parsing.
Inventory kernel package versions across the fleet and flag hosts running Thunderbolt-enabled kernels that predate the patch commits listed in the advisory.
Correlate udev Thunderbolt authorization events with subsequent kernel instability to identify suspicious devices.

Monitoring Recommendations

Forward kern.log, dmesg, and udev events to a centralized log platform for long-term retention and alerting on Thunderbolt-related faults.
Track Thunderbolt device authorizations through /sys/bus/thunderbolt/devices/*/authorized and alert on unexpected connections in server or kiosk environments.
Alert on kernel oops or panic patterns that match the vulnerable call path in the Thunderbolt driver.

How to Mitigate CVE-2026-74585

Immediate Actions Required

Update the Linux kernel to a version that includes one of the fix commits (3d3c212, 40d2ffb, 50f0c8d, 6c892ed, b98e1e2, d676499, f280660, or f32c3a9) provided by your distribution.
Restrict physical access to systems exposing Thunderbolt ports, especially servers, kiosks, and unattended endpoints.
Configure Thunderbolt security level to user or secure in firmware so that peripherals require explicit user authorization before enumeration.

Patch Information

Fixes are available across multiple stable branches through the upstream commits linked in the advisory. Consult the Kernel Patch 3d3c212, Kernel Patch 40d2ffb, Kernel Patch 50f0c8d, Kernel Patch 6c892ed, Kernel Patch b98e1e2, Kernel Patch d676499, Kernel Patch f280660, and Kernel Patch f32c3a9. Apply the vendor-provided kernel package matching your distribution and reboot.

Workarounds

Disable the Thunderbolt controller in system firmware where the port is not required for business use.
Blacklist the thunderbolt kernel module on systems that do not need Thunderbolt functionality using /etc/modprobe.d/.
Enforce a Thunderbolt security policy that blocks peripheral connections unless explicitly authorized by an administrator.

bash

# Blacklist the Thunderbolt module where it is not required
echo 'blacklist thunderbolt' | sudo tee /etc/modprobe.d/blacklist-thunderbolt.conf
sudo update-initramfs -u

# Verify current kernel version and Thunderbolt device state
uname -r
boltctl list