CVE-2026-74585

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> thunderbolt: Bound the DROM dual link port number before indexing sw-&gt;ports<br /> <br /> tb_drom_parse_entry_port() validates the device-supplied header-&gt;index<br /> against sw-&gt;config.max_port_number before indexing sw-&gt;ports[], but the<br /> sibling field entry-&gt;dual_link_port_nr -- a 6-bit value also read from<br /> the DROM -- indexes the same array with no such check. A malicious or<br /> malformed Thunderbolt device can set dual_link_port_nr beyond the<br /> allocated sw-&gt;ports[] (max_port_number + 1 entries), producing an<br /> out-of-bounds tb_port pointer that is stored and later dereferenced.<br /> <br /> Reject a port entry whose dual_link_port_nr exceeds max_port_number,<br /> the same bound already applied to header-&gt;index.