CVE-2026-63892
Received Received - Intake

Size_t Underflow in Linux Kernel Thunderbolt Property Parsing

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow On the non-root path, __tb_property_parse_dir() takes dir_len from entry->length (u16 widened to size_t). Two distinct OOB conditions follow when entry->length < 4: 1. The non-root path begins with kmemdup(&block[dir_offset], sizeof(*dir->uuid), ...) which always reads 4 dwords from dir_offset. tb_property_entry_valid() only enforces dir_offset + entry->length <= block_len, so a crafted entry with dir_offset close to the end of the property block and entry->length in 0..3 passes that gate but lets the UUID copy run off the block (e.g. dir_offset = 497, dir_len = 3 in a 500-dword block reads block[497..501]). 2. After the kmemdup, content_len = dir_len - 4 underflows size_t to ~SIZE_MAX, nentries becomes SIZE_MAX / 4, and the entry walk runs OOB on each iteration until an entry fails validation or the kernel oopses on an unmapped page. Reject dir_len < 4 on the non-root path *before* the UUID kmemdup, which closes both holes. Also move INIT_LIST_HEAD(&dir->properties) up to immediately after the dir allocation so the new error-return path (and the existing uuid-alloc failure path) calling tb_property_free_dir() sees a walkable list rather than the zero-initialized NULL next/prev that list_for_each_entry_safe() would oops on.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63892
EUVD
EUVD-2026-45665

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a size_t underflow issue in the Thunderbolt subsystem. When parsing property directories, a crafted entry with a length less than 4 can cause an out-of-bounds read or kernel oops. The issue arises because the code does not validate the directory length before performing operations that assume a minimum size.

Detection Guidance

This vulnerability is specific to the Linux kernel's Thunderbolt subsystem and requires local system access to detect. Check if your kernel version includes the fix by running uname -a and comparing against patched versions. Monitor system logs for Thunderbolt-related errors or crashes.

Impact Analysis

An attacker could exploit this to cause a denial-of-service (system crash) or potentially execute arbitrary code with kernel privileges. Systems using Thunderbolt devices are most at risk, especially if untrusted devices are connected.

Compliance Impact

This vulnerability is a memory safety issue in the Linux kernel's Thunderbolt subsystem that could lead to out-of-bounds memory access. It does not directly relate to data protection or privacy compliance standards like GDPR or HIPAA, which focus on unauthorized data access or disclosure. The impact on compliance would depend on whether this vulnerability could be exploited to access sensitive data or disrupt systems handling regulated data.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for CVE-2026-63892. If immediate patching is not possible, disable Thunderbolt functionality if not required, or restrict physical access to systems using Thunderbolt devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63892. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart