{"api_version":"1","generated_at":"2026-08-24T20:45:12+00:00","cve":"CVE-2026-72157","urls":{"html":"https://cve.report/CVE-2026-72157","api":"https://cve.report/api/cve/CVE-2026-72157.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72157","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72157"},"summary":{"title":"net: thunderbolt: Fix frags[] overflow by bounding frame_count","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: thunderbolt: Fix frags[] overflow by bounding frame_count\n\ntbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The\nfirst frame goes into the skb linear area and every further frame is added as\na page fragment.\n\n\tskb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,\n\t\t\tpage, hdr_size, frame_size,\n\t\t\tTBNET_RX_PAGE_SIZE - hdr_size);\n\nA packet of frame_count frames therefore ends up with frame_count - 1\nfragments. tbnet_check_frame() only bounds the peer supplied frame_count to\nTBNET_RING_SIZE / 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A\npeer that sends a packet of 19 or more small frames pushes nr_frags past\nMAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and\ncorrupts memory after the shared info.\n\nTighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never\nproduce more fragments than frags[] can hold. This matches the recent skb\nfrags overflow fixes in other receive paths, for example f0813bcd2d9d (\"net:\nwwan: t7xx: fix potential skb->frags overflow in RX path\") and 600dc40554dc\n(\"net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()\").","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:21:33","updated_at":"2026-08-23 13:16:40"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/fe6b606fbf0c3beb94ccf17fcf31d8c2138264e3","name":"https://git.kernel.org/stable/c/fe6b606fbf0c3beb94ccf17fcf31d8c2138264e3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2b3b4e5ff5a58ad32817824b0310e63908b12052","name":"https://git.kernel.org/stable/c/2b3b4e5ff5a58ad32817824b0310e63908b12052","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/569ba39b2d12995a29dc158e5b4de6e449278f30","name":"https://git.kernel.org/stable/c/569ba39b2d12995a29dc158e5b4de6e449278f30","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e5824d5b841d99a2bcdd4e2c256643293bbc22c1","name":"https://git.kernel.org/stable/c/e5824d5b841d99a2bcdd4e2c256643293bbc22c1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f96b3b35c622d565eff2438993e028d280163f5c","name":"https://git.kernel.org/stable/c/f96b3b35c622d565eff2438993e028d280163f5c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6262f51e09d8dc8b07599a9e4f03bd3989d13fff","name":"https://git.kernel.org/stable/c/6262f51e09d8dc8b07599a9e4f03bd3989d13fff","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e27beb4536cbf1d59e2d8c2840e87d972aba906f","name":"https://git.kernel.org/stable/c/e27beb4536cbf1d59e2d8c2840e87d972aba906f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/55d9895f89970501fe126d1026b586b04a224c27","name":"https://git.kernel.org/stable/c/55d9895f89970501fe126d1026b586b04a224c27","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72157","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72157","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e f96b3b35c622d565eff2438993e028d280163f5c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e 6262f51e09d8dc8b07599a9e4f03bd3989d13fff git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e 569ba39b2d12995a29dc158e5b4de6e449278f30 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e 2b3b4e5ff5a58ad32817824b0310e63908b12052 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e e27beb4536cbf1d59e2d8c2840e87d972aba906f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e e5824d5b841d99a2bcdd4e2c256643293bbc22c1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e fe6b606fbf0c3beb94ccf17fcf31d8c2138264e3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e 55d9895f89970501fe126d1026b586b04a224c27 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.15","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.15 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.266 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.217 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.184 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.145 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.97 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.40 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72157","cve":"CVE-2026-72157","epss":"0.003330000","percentile":"0.263800000","score_date":"2026-08-23","updated_at":"2026-08-24 00:11:15"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/thunderbolt/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f96b3b35c622d565eff2438993e028d280163f5c","status":"affected","version":"e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e","versionType":"git"},{"lessThan":"6262f51e09d8dc8b07599a9e4f03bd3989d13fff","status":"affected","version":"e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e","versionType":"git"},{"lessThan":"569ba39b2d12995a29dc158e5b4de6e449278f30","status":"affected","version":"e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e","versionType":"git"},{"lessThan":"2b3b4e5ff5a58ad32817824b0310e63908b12052","status":"affected","version":"e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e","versionType":"git"},{"lessThan":"e27beb4536cbf1d59e2d8c2840e87d972aba906f","status":"affected","version":"e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e","versionType":"git"},{"lessThan":"e5824d5b841d99a2bcdd4e2c256643293bbc22c1","status":"affected","version":"e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e","versionType":"git"},{"lessThan":"fe6b606fbf0c3beb94ccf17fcf31d8c2138264e3","status":"affected","version":"e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e","versionType":"git"},{"lessThan":"55d9895f89970501fe126d1026b586b04a224c27","status":"affected","version":"e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/thunderbolt/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.266","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.217","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.184","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.266","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.217","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.184","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.145","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.97","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.40","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"4.15","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: thunderbolt: Fix frags[] overflow by bounding frame_count\n\ntbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The\nfirst frame goes into the skb linear area and every further frame is added as\na page fragment.\n\n\tskb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,\n\t\t\tpage, hdr_size, frame_size,\n\t\t\tTBNET_RX_PAGE_SIZE - hdr_size);\n\nA packet of frame_count frames therefore ends up with frame_count - 1\nfragments. tbnet_check_frame() only bounds the peer supplied frame_count to\nTBNET_RING_SIZE / 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A\npeer that sends a packet of 19 or more small frames pushes nr_frags past\nMAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and\ncorrupts memory after the shared info.\n\nTighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never\nproduce more fragments than frags[] can hold. This matches the recent skb\nfrags overflow fixes in other receive paths, for example f0813bcd2d9d (\"net:\nwwan: t7xx: fix potential skb->frags overflow in RX path\") and 600dc40554dc\n(\"net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()\")."}],"metrics":[{"cvssV3_1":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:A - The flaw is triggered by malicious ThunderboltIP frames sent from a peer on the same direct Thunderbolt/USB4 link; exploitation is not Internet-routable but is reachable from an adjacent connected host, dock, or peripheral without local syscall access.\nAC:L - An adjacent peer can reliably trigger the overflow by sending a start-of-packet header with frame_count of 19-64 and delivering the matching small frames; no races or attacker-uncontrollable heap layout are required.\nPR:N - The attacker needs no account, capability, or privilege on the victim OS; a malicious Thunderbolt/USB4 peer that completes XDomain ThunderboltIP login can send the crafted RX frames directly over the established DMA path.\nUI:N - Once a ThunderboltIP session is active, which is common with docks, direct laptop-to-laptop links, and shared workstations, triggering the bug requires no further victim action beyond the existing link.\nS:U - Memory corruption occurs in the kernel Thunderbolt network driver during skb reassembly and does not by itself cross a VM, container, or IOMMU security boundary.\nC:H - skb_add_rx_frag() writes past skb_shinfo()->frags[], corrupting adjacent kernel memory; such out-of-bounds skb metadata corruption is reasonably leverageable for information disclosure as well as further exploitation.\nI:H - The overflow is an attacker-controlled out-of-bounds write of skb fragment descriptors beyond MAX_SKB_FRAGS, which can corrupt heap/skb metadata and be developed into arbitrary kernel memory modification or code execution.\nA:H - Corrupting memory past skb_shared_info can cause kernel oopses, panics, or unstable behavior during RX processing, and repeated malicious packets can deny service on affected systems."}]}],"providerMetadata":{"dateUpdated":"2026-08-23T12:46:55.998Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/f96b3b35c622d565eff2438993e028d280163f5c"},{"url":"https://git.kernel.org/stable/c/6262f51e09d8dc8b07599a9e4f03bd3989d13fff"},{"url":"https://git.kernel.org/stable/c/569ba39b2d12995a29dc158e5b4de6e449278f30"},{"url":"https://git.kernel.org/stable/c/2b3b4e5ff5a58ad32817824b0310e63908b12052"},{"url":"https://git.kernel.org/stable/c/e27beb4536cbf1d59e2d8c2840e87d972aba906f"},{"url":"https://git.kernel.org/stable/c/e5824d5b841d99a2bcdd4e2c256643293bbc22c1"},{"url":"https://git.kernel.org/stable/c/fe6b606fbf0c3beb94ccf17fcf31d8c2138264e3"},{"url":"https://git.kernel.org/stable/c/55d9895f89970501fe126d1026b586b04a224c27"}],"title":"net: thunderbolt: Fix frags[] overflow by bounding frame_count","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72157","datePublished":"2026-08-15T05:53:26.718Z","dateReserved":"2026-08-09T03:40:39.909Z","dateUpdated":"2026-08-23T12:46:55.998Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:21:33","lastModifiedDate":"2026-08-23 13:16:40","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72157","Ordinal":"1","Title":"net: thunderbolt: Fix frags[] overflow by bounding frame_count","CVE":"CVE-2026-72157","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72157","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: thunderbolt: Fix frags[] overflow by bounding frame_count\n\ntbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The\nfirst frame goes into the skb linear area and every further frame is added as\na page fragment.\n\n\tskb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,\n\t\t\tpage, hdr_size, frame_size,\n\t\t\tTBNET_RX_PAGE_SIZE - hdr_size);\n\nA packet of frame_count frames therefore ends up with frame_count - 1\nfragments. tbnet_check_frame() only bounds the peer supplied frame_count to\nTBNET_RING_SIZE / 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A\npeer that sends a packet of 19 or more small frames pushes nr_frags past\nMAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and\ncorrupts memory after the shared info.\n\nTighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never\nproduce more fragments than frags[] can hold. This matches the recent skb\nfrags overflow fixes in other receive paths, for example f0813bcd2d9d (\"net:\nwwan: t7xx: fix potential skb->frags overflow in RX path\") and 600dc40554dc\n(\"net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()\").","Type":"Description","Title":"net: thunderbolt: Fix frags[] overflow by bounding frame_count"}]}}}