CVE-2026-63893
Received Received - Intake

Integer Overflow in Linux Kernel Thunderbolt Subsystem

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() entry->value is u32 and entry->length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum 0x100000000 wraps to 0 and passes the > block_len check. tb_property_parse() then passes entry->value to parse_dwdata() as a dword offset into the property block, reading attacker-directed memory far past the allocation. For TEXT-typed entries with the "deviceid" or "vendorid" keys this lands in xd->device_name / xd->vendor_name and is readable back via the per-XDomain device_name / vendor_name sysfs attributes; the leak is NUL-bounded (kstrdup() stops at the first zero byte) and untargeted (the attacker picks a delta, not an absolute address). DATA-typed entries are parsed into property->value.data but not generically surfaced to userspace. Use check_add_overflow() so a wrapped sum is rejected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63893
EUVD
EUVD-2026-45666

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory corruption vulnerability in the Linux kernel's Thunderbolt subsystem. It occurs when processing property entries where the sum of a u32 value and u16 length wraps around to zero due to integer overflow. A malicious Thunderbolt XDomain peer can exploit this to read arbitrary kernel memory via sysfs attributes.

Detection Guidance

This vulnerability is specific to the Linux kernel's Thunderbolt subsystem and requires kernel-level inspection. Check if your system uses Thunderbolt by running lsmod | grep thunderbolt. If loaded, monitor sysfs attributes under /sys/bus/thunderbolt/devices/ for unexpected device_name or vendor_name values. No direct network detection is applicable as this is a local kernel memory leak.

Impact Analysis

An attacker with physical access to a Thunderbolt port could exploit this to read sensitive kernel memory. This may expose system information or allow further exploitation. The impact is limited to Thunderbolt-connected devices and requires local access.

Compliance Impact

This vulnerability could potentially lead to information disclosure by allowing an attacker to read memory past allocated buffers via malicious XDomain peer interactions. This may expose sensitive data, which could impact compliance with GDPR (data protection) or HIPAA (health information privacy) if such data is mishandled or leaked.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-63893. If immediate patching is not possible, disable Thunderbolt functionality by unloading the thunderbolt module (rmmod thunderbolt) or blacklisting it. Restrict physical access to Thunderbolt ports to prevent malicious XDomain peers from exploiting this.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63893. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart