CVE-2026-63891
Received Received - Intake

Thunderbolt Property Parser Stack Exhaustion in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A crafted peer that chains DIRECTORY entries into a back-reference loop drives the parser until the kernel stack is exhausted and the guard page fires. Any untrusted XDomain peer (cable, dock, in-line inspector, adjacent host) that reaches the PROPERTIES_REQUEST control-plane exchange can trigger this without authentication. Thread a depth counter through tb_property_parse() and __tb_property_parse_dir(), and reject blocks that exceed TB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any observed legitimate XDomain layout. Operators who do not need XDomain host-to-host discovery can disable the path entirely with thunderbolt.xdomain=0 on the kernel command line.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63891
EUVD
EUVD-2026-45664

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the Thunderbolt subsystem. It involves a stack exhaustion issue caused by recursive parsing of directory entries in Thunderbolt properties. A crafted peer device can create a loop of directory entries, causing the kernel to exhaust its stack space and trigger a guard page fault. The vulnerability is triggered during the PROPERTIES_REQUEST control-plane exchange without requiring authentication.

Detection Guidance

This vulnerability can be detected by checking for excessive recursion in Thunderbolt property parsing. Monitor kernel logs for stack overflow errors or guard page faults related to thunderbolt. Use commands like 'dmesg | grep -i thunderbolt' or 'journalctl -k | grep -i thunderbolt' to inspect kernel logs for suspicious activity.

Impact Analysis

If you use a system with Thunderbolt devices, an attacker could exploit this by connecting a malicious Thunderbolt device (like a cable or dock) to crash your system. This could lead to denial of service, system instability, or potential privilege escalation if combined with other vulnerabilities. Systems without Thunderbolt devices or with the feature disabled are not affected.

Compliance Impact

This vulnerability primarily impacts system availability and integrity. For GDPR, it could affect availability of services if exploited. For HIPAA, it might impact the integrity of systems handling protected health information. Compliance impact depends on whether the affected systems are part of regulated environments and whether mitigations are applied.

Mitigation Strategies

Disable XDomain host-to-host discovery by adding 'thunderbolt.xdomain=0' to the kernel command line. Update the Linux kernel to the patched version. If Thunderbolt is not required, consider blacklisting the thunderbolt module with 'modprobe -r thunderbolt'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63891. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart