This CVE exposes a fragment count overflow in the tbnet driver's receive path. The bug itself is straightforward: the driver trusts peer-supplied frame counts without validating them against MAX_SKB_FRAGS, allowing nr_frags to exceed the array boundary and corrupt heap memory. Apply the vendor patch promptly.
But the vulnerability is a symptom, not a cause. In the past year, three separate drivers have been patched for the identical flaw — tbnet, the t7xx WWAN driver, and usb/cdc-phonet. Each was treated as an isolated incident. None triggered the audit that the pattern demanded. The tbnet driver was merged in kernel 6.5, well after the first two instances were known, meaning new code was written using a flawed pattern that the kernel community had already published fixes for.
The underlying problem is that skb_add_rx_frag() accepts data that violates the MAX_SKB_FRAGS invariant without any enforcement or warning. Driver authors must independently know, remember, and enforce a constant that varies by architecture — a cognitive burden that produces predictable failures at scale. Until the network core enforces this invariant at insertion time, every untested driver path that handles peer-supplied fragment metadata is a candidate for the same vulnerability.
For risk prioritization: the Thunderbolt proximity requirement does narrow exploitability, but the same overflow pattern exists in drivers where the peer is a remote modem or USB device. The blast radius — memory corruption past the frags[] boundary — is identical regardless of attack surface. Organizations triaging this as low-priority based on physical access may be missing the same bug class in their WWAN or USB networking drivers.
What to do now: patch tbnet immediately, but treat the disclosure as a search warrant. Audit any network drivers handling peer-supplied frame metadata for identical bounds-checking gaps. The long-term fix is architectural enforcement at the skb layer, not per-driver patches — but that change has not yet landed, so the defensible posture is to find and fix the pattern in your kernel's driver set before an attacker does.