thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A crafted peer that chains DIRECTORY entries into a back-reference loop drives the parser until the kernel stack is exhausted and the guard page fires. Any untrusted XDomain peer (cable, dock, in-line inspector, adjacent host) that reaches the PROPERTIES_REQUEST control-plane exchange can trigger this without authentication. Thread a depth counter through tb_property_parse() and __tb_property_parse_dir(), and reject blocks that exceed TB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any observed legitimate XDomain layout. Operators who do not need XDomain host-to-host discovery can disable the path entirely with thunderbolt.xdomain=0 on the kernel command line.
CVE-2026-63891
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:CVE-2026-63891
Kernel
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 5.10.259
Source reference:
/affected/1/ranges5.15.210Source reference:
/affected/1/ranges6.1.176Source reference:
/affected/1/ranges6.6.143Source reference:
/affected/1/ranges6.12.93Source reference:
/affected/1/ranges6.18.35Source reference:
/affected/1/ranges7.0.12Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179"
},
{
"fixed": "2b5f47a710172c962ef42d1b732b04d2ad0dce21"
},
{
"fixed": "95839a67ea56ca35732aad7f711404a3127cfe2d"
},
{
"fixed": "0a84ab9271936c11e84e511bb52fc5682f8b6726"
},
{
"fixed": "b4621e5ef63405c317a84b711faf3bd75b3c6a94"
},
{
"fixed": "f31c6d220f455b5af63590302b30e1b932d14599"
},
{
"fixed": "830c8a9b467e7d3a158483d37fa7dc13892b293a"
},
{
"fixed": "ed9455ef4bd9babc90f92e526abe3fb68c1a8709"
},
{
"fixed": "928abe19fbf0127003abcb1ea69cabc1c897d0ab"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63891.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.15.0"
},
{
"fixed": "5.10.259"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.210"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.176"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.143"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.93"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.35"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.0.12"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63891.json"
}
}
]- Related CVEs
- CVE-2026-63891
Source reference:
/id
Publisher severity
No explicit severity was provided.
- Event
- #50762 · Revision 1
- Added to Heist Feed
- Publisher date