CVE-2026-72157 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net: thunderbolt: Fix frags[] overflow by bounding frame_count
tbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment.
skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, hdr_size, frame_size, TBNET_RX_PAGE_SIZE - hdr_size);
A packet of frame_count frames therefore ends up with frame_count - 1 fragments. tbnet_check_frame() only bounds the peer supplied frame_count to TBNET_RING_SIZE / 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A peer that sends a packet of 19 or more small frames pushes nr_frags past MAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and
corrupts memory after the shared info.
Tighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never produce more fragments than frags[] can hold. This matches the recent skb
frags overflow fixes in other receive paths, for example f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path") and 600dc40554dc ("net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()").
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides within the Linux kernel's Thunderbolt network driver implementation, specifically in the tbnet_poll() function that handles reception of multi-frame ThunderboltIP packets. This function aggregates multiple frames into a single socket buffer (skb) structure where the initial frame is placed in the linear data area while subsequent frames are appended as page fragments. The core issue emerges from inadequate bounds checking on the peer-provided frame_count parameter which governs how many frames constitute a complete packet. While tbnet_check_frame() does impose a limit of TBNET_RING_SIZE / 4 (64 frames) on this parameter, this bound remains significantly higher than the kernel's default maximum number of skb fragments defined by MAX_SKB_FRAGS, which stands at 17 fragments.
The technical flaw occurs when a malicious peer sends a packet containing 19 or more small frames, causing the total fragment count to exceed MAX_SKB_FRAGS. This overflow condition arises because each additional frame beyond the first contributes one fragment to the skb structure, resulting in frame_count - 1 fragments for a packet with frame_count frames. When the number of fragments surpasses the allocated frags[] array capacity within skb_shinfo(), the kernel's memory management system experiences buffer overflows that write beyond the intended bounds into adjacent memory regions, potentially corrupting critical kernel data structures and compromising system stability.
This vulnerability directly maps to CWE-129, which addresses improper validation of the upper bound of an array, and relates to ATT&CK technique T1059.001 for command and scripting interpreter execution through kernel-level memory corruption. The attack surface involves network-based exploitation where remote adversaries can craft malicious Thunderbolt frames to trigger the overflow condition without requiring local privileges. The operational impact includes potential system crashes, data corruption, and in severe cases, privilege escalation or denial of service scenarios that could affect entire Thunderbolt device ecosystems.
The fix implements a stricter upper bound on the frame_count parameter by limiting it to MAX_SKB_FRAGS + 1, ensuring that no packet can ever generate more fragments than the frags[] array can accommodate. This approach aligns with recent kernel security improvements in similar network subsystems, specifically following patterns established in fixes for other receive paths such as the WWAN t7xx driver and USB cdc-phonet implementations. These parallel fixes demonstrate a coordinated effort within the Linux kernel community to address skb fragment overflow vulnerabilities across various network interfaces, reinforcing defensive programming practices that prevent memory corruption through proper input validation and resource boundary enforcement.
The mitigation strategy requires updating kernel versions containing this specific fix, with system administrators prioritizing patch deployment for systems utilizing Thunderbolt networking capabilities. Organizations should also consider implementing network segmentation and monitoring for anomalous frame count patterns that might indicate exploitation attempts. The solution maintains backward compatibility while strengthening the kernel's memory safety mechanisms, aligning with security best practices that emphasize defensive programming and comprehensive input validation to prevent exploitation of memory corruption vulnerabilities in kernel space operations.