CVE-2026-63891 (GCVE-0-2026-63891)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-07-19 14:55
VLAI
Title
thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
Summary
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A crafted peer that chains DIRECTORY entries into a back-reference loop drives the parser until the kernel stack is exhausted and the guard page fires. Any untrusted XDomain peer (cable, dock, in-line inspector, adjacent host) that reaches the PROPERTIES_REQUEST control-plane exchange can trigger this without authentication. Thread a depth counter through tb_property_parse() and __tb_property_parse_dir(), and reject blocks that exceed TB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any observed legitimate XDomain layout. Operators who do not need XDomain host-to-host discovery can disable the path entirely with thunderbolt.xdomain=0 on the kernel command line.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < 2b5f47a710172c962ef42d1b732b04d2ad0dce21 (git)
Affected: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < 95839a67ea56ca35732aad7f711404a3127cfe2d (git)
Affected: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < 0a84ab9271936c11e84e511bb52fc5682f8b6726 (git)
Affected: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < b4621e5ef63405c317a84b711faf3bd75b3c6a94 (git)
Affected: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < f31c6d220f455b5af63590302b30e1b932d14599 (git)
Affected: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < 830c8a9b467e7d3a158483d37fa7dc13892b293a (git)
Affected: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < ed9455ef4bd9babc90f92e526abe3fb68c1a8709 (git)
Affected: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 , < 928abe19fbf0127003abcb1ea69cabc1c897d0ab (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/thunderbolt/property.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2b5f47a710172c962ef42d1b732b04d2ad0dce21",
              "status": "affected",
              "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
              "versionType": "git"
            },
            {
              "lessThan": "95839a67ea56ca35732aad7f711404a3127cfe2d",
              "status": "affected",
              "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
              "versionType": "git"
            },
            {
              "lessThan": "0a84ab9271936c11e84e511bb52fc5682f8b6726",
              "status": "affected",
              "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
              "versionType": "git"
            },
            {
              "lessThan": "b4621e5ef63405c317a84b711faf3bd75b3c6a94",
              "status": "affected",
              "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
              "versionType": "git"
            },
            {
              "lessThan": "f31c6d220f455b5af63590302b30e1b932d14599",
              "status": "affected",
              "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
              "versionType": "git"
            },
            {
              "lessThan": "830c8a9b467e7d3a158483d37fa7dc13892b293a",
              "status": "affected",
              "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
              "versionType": "git"
            },
            {
              "lessThan": "ed9455ef4bd9babc90f92e526abe3fb68c1a8709",
              "status": "affected",
              "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
              "versionType": "git"
            },
            {
              "lessThan": "928abe19fbf0127003abcb1ea69cabc1c897d0ab",
              "status": "affected",
              "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/thunderbolt/property.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: property: Cap recursion depth in __tb_property_parse_dir()\n\nA DIRECTORY entry\u0027s value field is used as the dir_offset for a\nrecursive call into __tb_property_parse_dir() with no depth counter.\nA crafted peer that chains DIRECTORY entries into a back-reference\nloop drives the parser until the kernel stack is exhausted and the\nguard page fires.  Any untrusted XDomain peer (cable, dock, in-line\ninspector, adjacent host) that reaches the PROPERTIES_REQUEST\ncontrol-plane exchange can trigger this without authentication.\n\nThread a depth counter through tb_property_parse() and\n__tb_property_parse_dir(), and reject blocks that exceed\nTB_PROPERTY_MAX_DEPTH = 8.  That is comfortably larger than any\nobserved legitimate XDomain layout.\n\nOperators who do not need XDomain host-to-host discovery can disable\nthe path entirely with thunderbolt.xdomain=0 on the kernel command\nline."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T14:55:02.840Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2b5f47a710172c962ef42d1b732b04d2ad0dce21"
        },
        {
          "url": "https://git.kernel.org/stable/c/95839a67ea56ca35732aad7f711404a3127cfe2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a84ab9271936c11e84e511bb52fc5682f8b6726"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4621e5ef63405c317a84b711faf3bd75b3c6a94"
        },
        {
          "url": "https://git.kernel.org/stable/c/f31c6d220f455b5af63590302b30e1b932d14599"
        },
        {
          "url": "https://git.kernel.org/stable/c/830c8a9b467e7d3a158483d37fa7dc13892b293a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed9455ef4bd9babc90f92e526abe3fb68c1a8709"
        },
        {
          "url": "https://git.kernel.org/stable/c/928abe19fbf0127003abcb1ea69cabc1c897d0ab"
        }
      ],
      "title": "thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63891",
    "datePublished": "2026-07-19T14:55:02.840Z",
    "dateReserved": "2026-07-19T07:54:57.019Z",
    "dateUpdated": "2026-07-19T14:55:02.840Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63891",
      "date": "2026-09-21",
      "epss": "0.00275",
      "percentile": "0.20089"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/thunderbolt/property.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2b5f47a710172c962ef42d1b732b04d2ad0dce21",
                    "status": "affected",
                    "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "95839a67ea56ca35732aad7f711404a3127cfe2d",
                    "status": "affected",
                    "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0a84ab9271936c11e84e511bb52fc5682f8b6726",
                    "status": "affected",
                    "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b4621e5ef63405c317a84b711faf3bd75b3c6a94",
                    "status": "affected",
                    "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f31c6d220f455b5af63590302b30e1b932d14599",
                    "status": "affected",
                    "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "830c8a9b467e7d3a158483d37fa7dc13892b293a",
                    "status": "affected",
                    "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ed9455ef4bd9babc90f92e526abe3fb68c1a8709",
                    "status": "affected",
                    "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "928abe19fbf0127003abcb1ea69cabc1c897d0ab",
                    "status": "affected",
                    "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/thunderbolt/property.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.15"
                  },
                  {
                    "lessThan": "4.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: property: Cap recursion depth in __tb_property_parse_dir()\n\nA DIRECTORY entry\u0027s value field is used as the dir_offset for a\nrecursive call into __tb_property_parse_dir() with no depth counter.\nA crafted peer that chains DIRECTORY entries into a back-reference\nloop drives the parser until the kernel stack is exhausted and the\nguard page fires.  Any untrusted XDomain peer (cable, dock, in-line\ninspector, adjacent host) that reaches the PROPERTIES_REQUEST\ncontrol-plane exchange can trigger this without authentication.\n\nThread a depth counter through tb_property_parse() and\n__tb_property_parse_dir(), and reject blocks that exceed\nTB_PROPERTY_MAX_DEPTH = 8.  That is comfortably larger than any\nobserved legitimate XDomain layout.\n\nOperators who do not need XDomain host-to-host discovery can disable\nthe path entirely with thunderbolt.xdomain=0 on the kernel command\nline."
          }
        ],
        "id": "CVE-2026-63891",
        "lastModified": "2026-07-27T17:44:23.777",
        "metrics": {},
        "published": "2026-07-19T16:17:06.440",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0a84ab9271936c11e84e511bb52fc5682f8b6726"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2b5f47a710172c962ef42d1b732b04d2ad0dce21"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/830c8a9b467e7d3a158483d37fa7dc13892b293a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/928abe19fbf0127003abcb1ea69cabc1c897d0ab"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/95839a67ea56ca35732aad7f711404a3127cfe2d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b4621e5ef63405c317a84b711faf3bd75b3c6a94"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ed9455ef4bd9babc90f92e526abe3fb68c1a8709"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f31c6d220f455b5af63590302b30e1b932d14599"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-21T14:41:55+00:00",
      "cve": "CVE-2026-63891",
      "id": "CVE-2026-63891",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63891.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:46:53Z",
      "cve": "CVE-2026-63891",
      "id": "CVE-2026-63891",
      "initial_release_date": "2026-07-21T13:04:08Z",
      "product_status:first_fixed": "23",
      "product_status:known_affected": "727",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63891",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63891.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.