What is the CVSS score of CVE-2026-72157?

CVE-2026-72157 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72157?

Linux kernel ThunderboltIP vulnerability (CVE-2026-72157) enables adjacent network attackers to trigger kernel memory corruption on affected systems.. A patch is available.

How to fix or mitigate CVE-2026-72157?

Within 24 hours, identify all Linux systems with Thunderbolt support and assess which have exposure from adjacent networks. Within 7 days, obtain the vendor-released patch, test it in non-production environments, and prioritize systems with external-facing Thunderbolt interfaces. Within 30 days, deploy patches to all affected Linux systems organization-wide, or implement network segmentation to isolate Thunderbolt interfaces if patching cannot be completed immediately.

Linux Kernel CVE-2026-72157

EUVD-2026-58915 HIGH

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-8f5r-c72f-67g5

Buffer Overflow Linux Suse

8.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent vector because Thunderbolt requires physical proximity; no network-layer authentication for peer frames; kernel memory corruption yields full CIA impact on the host.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 07:19 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 06:21 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: thunderbolt: Fix frags[] overflow by bounding frame_count

tbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment.

skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, hdr_size, frame_size, TBNET_RX_PAGE_SIZE - hdr_size);

A packet of frame_count frames therefore ends up with frame_count - 1 fragments. tbnet_check_frame() only bounds the peer supplied frame_count to TBNET_RING_SIZE / 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A peer that sends a packet of 19 or more small frames pushes nr_frags past MAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and corrupts memory after the shared info.

Tighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never produce more fragments than frags[] can hold. This matches the recent skb frags overflow fixes in other receive paths, for example f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path") and 600dc40554dc ("net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()").

AnalysisAI

Memory corruption in the Linux kernel's ThunderboltIP receive path allows an adjacent unauthenticated attacker to overflow the skb frags[] array by sending a crafted multi-frame packet with 19 or more small frames. The insufficient frame_count bound in tbnet_check_frame() (capped at TBNET_RING_SIZE/4 = 64) far exceeds MAX_SKB_FRAGS (17), causing skb_add_rx_frag() to write past the frags[] array and corrupt kernel memory. EPSS is low (0.21%, 11th percentile), no public exploit exists, and CISA KEV confirmation is absent, but CVSS 8.8 reflects the severity of kernel memory corruption once Thunderbolt physical access is achieved.

Technical ContextAI

The vulnerability resides in drivers/net/thunderbolt.c, the ThunderboltIP networking subsystem of the Linux kernel, introduced at commit e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e in Linux 4.15. ThunderboltIP enables IP-layer networking between Thunderbolt-connected peers. The NAPI poll handler tbnet_poll() assembles multi-frame packets by placing the first frame in the skb linear area and appending each subsequent frame as a page fragment via skb_add_rx_frag(). The skb_shinfo()->frags[] array is statically sized at MAX_SKB_FRAGS (17 entries by default). The validation function tbnet_check_frame() permitted frame_count values up to TBNET_RING_SIZE/4 (64), which means a packet with 19 frames would produce 18 fragments - one past the array boundary - causing an out-of-bounds write (functionally CWE-787, though NVD lists CWE as N/A). This class of vulnerability is structurally identical to fixes applied to the wwan t7xx driver (f0813bcd2d9d) and USB CDC Phonet driver (600dc40554dc). The fix tightens the bound to MAX_SKB_FRAGS + 1.

RemediationAI

Upgrade to a patched Linux kernel version: 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1, per the upstream stable commits at https://git.kernel.org/stable/c/. Distribution users should apply vendor security updates as they become available for RHEL, Debian, Ubuntu, SUSE, and other supported kernel variants. If immediate kernel patching is not feasible, the primary compensating control is to unload or blacklist the thunderbolt module by adding blacklist thunderbolt to /etc/modprobe.d/blacklist.conf and running modprobe -r thunderbolt; this disables all Thunderbolt functionality including peripheral connectivity, which may be operationally disruptive. A less disruptive alternative is to enforce Thunderbolt security levels at the BIOS/UEFI or via the sysfs thunderbolt_security interface (e.g., setting security=user or security=secure) to require explicit device authorization before peer connections are established, reducing the attack surface without fully disabling Thunderbolt. Note that sysfs-based authorization controls reduce risk but do not patch the underlying frags[] overflow in the receive path.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72157 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72157

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code