Linux 4.21 Will Better Protect Against Malicious Thunderbolt Devices

Written by Michael Larabel in Hardware on 10 December 2018 at 02:45 PM EST. Add A Comment
Linux 4.21 is set to further improve the system security around potentially malicious Thunderbolt devices.

The new protection with Linux 4.21 is the enabling of IOMMU-based direct memory access (DMA) protection from devices connected via Thunderbolt. PCI Express Address Translation Services (PCIe ATS) is also disabled to prevent possibly bypassing that IOMMU protection, per this pull.

DMA protection via IOMMU has appeared on systems/motherboards beginning this year and ensures that Thunderbolt devices cannot access memory regions outside of where they should be permitted. On supported systems, this protection will be automatically enabled. Likewise, the PCIe ATS support is automatically going to be disabled for all "untrusted" Thunderbolt devices.

These latest kernel enhancements paired with the other efforts namely Red Hat's Bolt initiative have led to much better Thunderbolt device safety on Linux this year.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via

Popular News This Week