CVE-2026-63892 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
On the non-root path, __tb_property_parse_dir() takes dir_len from entry->length (u16 widened to size_t). Two distinct OOB conditions follow when entry->length < 4:
1. The non-root path begins with kmemdup(&block[dir_offset],
sizeof(*dir->uuid), ...) which always reads 4 dwords from dir_offset. tb_property_entry_valid() only enforces dir_offset + entry->length <= block_len, so a crafted entry with dir_offset close to the end of the property block and entry->length in 0..3 passes that gate but lets the UUID copy run off the block (e.g. dir_offset = 497, dir_len = 3 in a 500-dword block reads block[497..501]).
2. After the kmemdup, content_len = dir_len - 4 underflows size_t to ~SIZE_MAX, nentries becomes SIZE_MAX / 4, and the entry walk runs OOB on each iteration until an entry fails validation or the kernel oopses on an unmapped page.
Reject dir_len < 4 on the non-root path *before* the UUID kmemdup, which closes both holes.
Also move INIT_LIST_HEAD(&dir->properties) up to immediately after the dir allocation so the new error-return path (and the existing uuid-alloc failure path) calling tb_property_free_dir() sees a walkable list rather than the zero-initialized NULL next/prev that list_for_each_entry_safe() would oops on.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability in question affects the linux kernel's thunderbolt subsystem where a flaw exists in the property parsing mechanism that could lead to arbitrary code execution or system instability. This issue specifically resides within the __tb_property_parse_dir() function which processes directory entries from thunderbolt property blocks. The core problem stems from inadequate input validation of the dir_len parameter, which is derived from entry->length and cast to size_t type without proper bounds checking.
The technical implementation flaw manifests through two distinct out-of-bounds memory access conditions that occur when the dir_len value falls below four bytes. The first condition arises during the kmemdup operation where the code always attempts to read four dwords from the directory offset regardless of the actual entry length. This creates a scenario where a maliciously crafted property entry with dir_offset positioned near the end of the block and entry->length values between zero and three can bypass validation checks while still causing memory corruption. The validation function tb_property_entry_valid() only ensures that dir_offset plus entry->length does not exceed the block length, leaving room for exploitation when the offset is close to block boundaries.
The second vulnerability emerges after the kmemdup operation where content_len = dir_len - 4 causes a size_t underflow when dir_len is less than four. This underflow results in content_len assuming a value of approximately SIZE_MAX, which then propagates through calculations causing nentries to become extremely large and leading to out-of-bounds iteration through entry processing. The iterative loop continues until kernel memory corruption occurs or system crashes due to access to unmapped pages. This type of vulnerability falls under the category of integer underflow/overflow as classified by cwe-191, which represents a fundamental weakness in data handling that can lead to memory corruption.
The operational impact of this vulnerability extends beyond simple denial of service scenarios to potentially enable privilege escalation or remote code execution depending on the attack surface. Attackers could craft malicious thunderbolt property blocks that would cause the kernel to execute arbitrary code when processing these entries, particularly during device enumeration or configuration phases. The vulnerability affects systems running affected kernel versions where thunderbolt devices are present and actively being processed by the kernel's property parsing subsystem.
The recommended mitigation strategy involves implementing early validation of dir_len values before any memory operations occur, specifically rejecting entries with dir_len values less than four on the non-root path. This approach prevents both identified out-of-bounds access conditions from manifesting and ensures proper memory boundaries are maintained throughout the processing pipeline. Additionally, the fix includes reordering initialization of the properties list to ensure proper cleanup paths are available even when error conditions occur during allocation or processing phases.
This vulnerability demonstrates weaknesses in kernel input validation practices and highlights the importance of defensive programming techniques such as early exit conditions and comprehensive parameter checking before memory operations. The remediation approach aligns with established security principles that emphasize input sanitization and boundary checking, which are fundamental requirements in secure coding practices as outlined by various cybersecurity frameworks including those referenced in nist 800-53 security controls. The fix represents a targeted defensive measure that prevents exploitation while maintaining backward compatibility with legitimate thunderbolt device configurations.
The implementation of this patch addresses multiple attack vectors within the kernel's memory management subsystem, particularly those involving untrusted input from hardware devices. The solution follows best practices for kernel security hardening and reduces the attack surface for potential exploitation through crafted device property data. This vulnerability classification aligns with common exploit patterns found in kernel-level vulnerabilities and represents a typical example of how seemingly minor boundary checking deficiencies can lead to serious security implications in operating system components that handle hardware interface protocols.