CVE-2026-74585

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Bound the DROM dual link port number before indexing sw->ports

tbdromparseentryport() validates the device-supplied header->index against sw->config.maxportnumber before indexing sw->ports[], but the sibling field entry->duallinkportnr -- a 6-bit value also read from the DROM -- indexes the same array with no such check. A malicious or malformed Thunderbolt device can set duallinkportnr beyond the allocated sw->ports[] (maxportnumber + 1 entries), producing an out-of-bounds tb_port pointer that is stored and later dereferenced.

Reject a port entry whose duallinkportnr exceeds maxport_number, the same bound already applied to header->index.