CVE-2026-74585: thunderbolt: Bound the DROM dual link port number before indexing sw->ports

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Bound the DROM dual link port number before indexing sw->ports

tb_drom_parse_entry_port() validates the device-supplied header->index
against sw->config.max_port_number before indexing sw->ports[], but the
sibling field entry->dual_link_port_nr -- a 6-bit value also read from
the DROM -- indexes the same array with no such check. A malicious or
malformed Thunderbolt device can set dual_link_port_nr beyond the
allocated sw->ports[] (max_port_number + 1 entries), producing an
out-of-bounds tb_port pointer that is stored and later dereferenced.

Reject a port entry whose dual_link_port_nr exceeds max_port_number,
the same bound already applied to header->index.

The Linux kernel CVE team has assigned CVE-2026-74585 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.17 with commit cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 and fixed in 5.10.265 with commit 6c892ed9f4129ae40ef0f92e1bb31aa0b0ddc72c
	Issue introduced in 3.17 with commit cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 and fixed in 5.15.216 with commit 3d3c212b70633332ab71672aa2bc6af257d2ec83
	Issue introduced in 3.17 with commit cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 and fixed in 6.1.183 with commit b98e1e28bd95b0fa33164eec1e763d26c7058b39
	Issue introduced in 3.17 with commit cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 and fixed in 6.6.152 with commit 50f0c8dd8c3390f851cfb97ca13116f9ee6469d1
	Issue introduced in 3.17 with commit cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 and fixed in 6.12.104 with commit f28066057134aa9294caa597b670daf505ad9dce
	Issue introduced in 3.17 with commit cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 and fixed in 6.18.45 with commit 40d2ffb74094cf36edbe05855566a4c58b6ce808
	Issue introduced in 3.17 with commit cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 and fixed in 7.1.9 with commit f32c3a9a77cfb50934a60b05d5407649af062535
	Issue introduced in 3.17 with commit cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 and fixed in 7.2 with commit d6764992f17b23d91ff93ce905ab53c2aa7191f0

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74585
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/thunderbolt/eeprom.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6c892ed9f4129ae40ef0f92e1bb31aa0b0ddc72c
	https://git.kernel.org/stable/c/3d3c212b70633332ab71672aa2bc6af257d2ec83
	https://git.kernel.org/stable/c/b98e1e28bd95b0fa33164eec1e763d26c7058b39
	https://git.kernel.org/stable/c/50f0c8dd8c3390f851cfb97ca13116f9ee6469d1
	https://git.kernel.org/stable/c/f28066057134aa9294caa597b670daf505ad9dce
	https://git.kernel.org/stable/c/40d2ffb74094cf36edbe05855566a4c58b6ce808
	https://git.kernel.org/stable/c/f32c3a9a77cfb50934a60b05d5407649af062535
	https://git.kernel.org/stable/c/d6764992f17b23d91ff93ce905ab53c2aa7191f0