CVE-2026-74585: linux

CVSS: UnknownReceived
AliasesUBUNTU-CVE-2026-74585DEBIAN-CVE-2026-74585
Published 22-08-2026Last modified 22-08-2026
Open JSON

Vulnerability summary

CVE-2026-74585 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.8% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.18%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 6
MGASA-2026-0506SUSE-SU-2026:4687-1USN-8875-1USN-8875-2USN-8877-1USN-8878-1

Timeline

  1. 22-08-2026
    PublishedVulnerability first disclosed.

Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound the DROM dual link port number before indexing sw->ports tb_drom_parse_entry_port() validates the device-supplied header->index against sw->config.max_port_number before indexing sw->ports[], but the sibling field entry->dual_link_port_nr -- a 6-bit value also read from the DROM -- indexes the same array with no such check. A malicious or malformed Thunderbolt device can set dual_link_port_nr beyond the allocated sw->ports[] (max_port_number + 1 entries), producing an out-of-bounds tb_port pointer that is stored and later dereferenced. Reject a port entry whose dual_link_port_nr exceeds max_port_number, the same bound already applied to header->index.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

0.00 pp

From 0.18% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.187-1 | < 6.12.105-1 | < 7.1.9-1
  • linux-6.12< 6.12.107-1~deb12u1
Linux1 product
  • linux≥ cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6, < 6c892ed9f4129ae40ef0f92e1bb31aa0b0ddc72c | ≥ cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6, < 3d3c212b70633332ab71672aa2bc6af257d2ec83 | ≥ cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6, < b98e1e28bd95b0fa33164eec1e763d26c7058b39 | ≥ cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6, < 50f0c8dd8c3390f851cfb97ca13116f9ee6469d1 | ≥ cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6, < f28066057134aa9294caa597b670daf505ad9dce | ≥ cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6, < 40d2ffb74094cf36edbe05855566a4c58b6ce808 | ≥ cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6, < f32c3a9a77cfb50934a60b05d5407649af062535 | ≥ cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6, < d6764992f17b23d91ff93ce905ab53c2aa7191f0 | 3.17

3 vendors · 172 products

References

17 links
Show all 17 references