CVE-2026-63892 Overview
CVE-2026-63892 is a Linux kernel vulnerability in the Thunderbolt property parser. The flaw resides in __tb_property_parse_dir() where dir_len is derived from entry->length (a u16 widened to size_t). When a crafted property block contains an entry with entry->length < 4, two distinct out-of-bounds conditions occur: an OOB read during a kmemdup() of the UUID, and a size_t underflow when computing content_len = dir_len - 4, which wraps to near SIZE_MAX and drives an OOB walk over kernel memory.
Critical Impact
A malicious or malformed Thunderbolt device can trigger out-of-bounds kernel memory reads and a kernel oops, resulting in denial of service and potential information disclosure.
Affected Products
- Linux kernel — Thunderbolt subsystem (drivers/thunderbolt/property.c)
- Stable branches referenced in the upstream fixes
- Systems exposing Thunderbolt/USB4 property directory parsing to peripheral input
Discovery Timeline
- 2026-07-19 - CVE-2026-63892 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-63892
Vulnerability Analysis
The Thunderbolt property parser walks a directory structure supplied through a peer device's property block. On the non-root path, __tb_property_parse_dir() reads dir_len from entry->length, a 16-bit field widened to size_t. The validator tb_property_entry_valid() only checks that dir_offset + entry->length <= block_len. It does not enforce a minimum entry->length.
The parser then calls kmemdup(&block[dir_offset], sizeof(*dir->uuid), ...), which unconditionally reads four dwords starting at dir_offset. When entry->length is between 0 and 3, the validator still accepts the entry, but the UUID copy runs past the end of the block. For example, a block of 500 dwords with dir_offset = 497 and dir_len = 3 reads block[497..501].
After the kmemdup, the code computes content_len = dir_len - 4. With dir_len < 4, the subtraction underflows the unsigned size_t to a value near SIZE_MAX. The derived nentries = SIZE_MAX / 4 then drives the entry walk far out of bounds until validation fails or the kernel oopses on an unmapped page.
Root Cause
The root cause is missing input validation combined with an unsigned integer underflow [CWE-191]. The parser trusts an attacker-controlled 16-bit length field and performs arithmetic without a lower bound check, yielding both an out-of-bounds read [CWE-125] and a size_t underflow that expands the loop bound.
Attack Vector
Exploitation requires the ability to present a crafted Thunderbolt property block to the host, typically through a malicious or malformed Thunderbolt/USB4 peripheral. This constitutes physical or peripheral-adjacent access. Successful exploitation causes kernel memory reads past the property block and can crash the kernel through the runaway entry walk.
The fix rejects dir_len < 4 on the non-root path before the UUID kmemdup, closing both the OOB read and the underflow. The patch also moves INIT_LIST_HEAD(&dir->properties) immediately after directory allocation so that the new error path calling tb_property_free_dir() sees a valid list head rather than zero-initialized pointers that would oops in list_for_each_entry_safe().
Detection Methods for CVE-2026-63892
Indicators of Compromise
- Kernel oops or panic messages referencing __tb_property_parse_dir, tb_property_free_dir, or list_for_each_entry_safe in the Thunderbolt driver stack.
- Unexpected Thunderbolt device enumeration failures accompanied by memory access faults in dmesg.
- KASAN reports indicating out-of-bounds reads within the Thunderbolt property block region.
Detection Strategies
- Enable KASAN on test systems and exercise Thunderbolt device attach flows to surface OOB reads in drivers/thunderbolt/property.c.
- Monitor kernel logs for Oops or BUG entries correlated with Thunderbolt hotplug events.
- Track kernel package versions across the fleet and flag hosts still running unpatched Thunderbolt-capable kernels.
Monitoring Recommendations
- Alert on repeated Thunderbolt controller resets or driver reload sequences on endpoints and workstations.
- Log peripheral connection events from udev and correlate with kernel crash telemetry.
- Baseline expected Thunderbolt device identifiers per host and alert on unknown or unauthorized attachments.
How to Mitigate CVE-2026-63892
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced below to all Thunderbolt-capable systems.
- Restrict Thunderbolt device authorization to trusted peripherals only, using BOLT or boltctl policies.
- Where patching is delayed, disable Thunderbolt in firmware on systems that do not require it.
Patch Information
The fix is available across multiple stable branches. Refer to the upstream commits: Kernel Patch 37abc450, Kernel Patch 3bec49c, Kernel Patch 542a138, Kernel Patch 5506c825, Kernel Patch d548179, Kernel Patch de21b59, Kernel Patch de618299, and Kernel Patch e2d4d51c.
Workarounds
- Set Thunderbolt security level to USER or SECURE in system firmware to require explicit device authorization.
- Use boltctl to enroll only known-good devices and deny automatic connections.
- Physically restrict access to Thunderbolt ports on high-value hosts pending kernel updates.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
