The Linux kernel Thunderbolt subsystem had a vulnerability where tb_property_entry_valid() did not properly handle 32-bit unsigned integer wraparound when summing entry->value (u32) and entry->length (u16). An attacker controlling a cross-domain peer could set entry->value to 0xffffff00 and entry->length to 0x100, causing the sum to wrap to zero and pass validation incorrectly. This led to tb_property_parse() passing a malicious offset to parse_dwdata(), resulting in reading memory beyond the intended property block. For TEXT-typed entries with keys "deviceid" or "vendorid", this out-of-bounds read could leak kernel memory content through sysfs device_name or vendor_name attributes. The leak is limited by NUL termination and is untargeted since the attacker controls only the offset delta. The fix involved using check_add_overflow() to detect and reject wrapped sums.

An attacker with the ability to act as a malicious cross-domain peer in the Thunderbolt subsystem could cause out-of-bounds reads of kernel memory, potentially leaking sensitive information via sysfs attributes device_name or vendor_name. The leak is limited by NUL termination and is not precisely targeted, reducing the severity of information disclosure. There is no indication of code execution or privilege escalation from this vulnerability.

A fix has been implemented in the Linux kernel to reject 32-bit unsigned integer wraparound in tb_property_entry_valid() by using check_add_overflow(). Users should apply the official Linux kernel updates that include this patch to remediate the vulnerability. No additional mitigation is indicated by the vendor advisory.