The Linux kernel Thunderbolt driver function tb_drom_parse_entry_port() originally validated the device-supplied header->index against sw->config.max_port_number before indexing the sw->ports array. However, the sibling field entry->dual_link_port_nr, a 6-bit value also read from the device's DROM, was used to index the same array without bounds checking. A malicious or malformed Thunderbolt device could set dual_link_port_nr beyond the allocated array size, causing an out-of-bounds pointer to be stored and later dereferenced. The fix adds a check to reject port entries where dual_link_port_nr exceeds max_port_number, preventing out-of-bounds access.

This vulnerability could allow a malicious or malformed Thunderbolt device to cause out-of-bounds memory access in the kernel by providing an invalid dual_link_port_nr value. This may lead to kernel memory corruption or crashes. No known exploits in the wild have been reported. The impact is limited to systems with Thunderbolt support and vulnerable kernel versions.

A fix has been applied to the Linux kernel to add bounds checking for the dual_link_port_nr field, preventing out-of-bounds indexing. Users should update their Linux kernel to a version that includes this fix once available. Patch status is not yet confirmed from vendor advisory; check the official Linux kernel release notes or advisories for the fixed version and apply updates accordingly.