CVE-2026-63893: Linux Kernel Information Disclosure Flaw

CVE-2026-63893 Overview

CVE-2026-63893 is an integer overflow vulnerability in the Linux kernel's Thunderbolt subsystem. The flaw resides in tb_property_entry_valid() within the XDomain property parsing code. A malicious XDomain peer can craft an entry where entry->value (u32) and entry->length (u16) sum to a value that wraps in u32 arithmetic, bypassing the > block_len bounds check.

Once the check is bypassed, tb_property_parse() passes the attacker-controlled entry->value to parse_dwdata() as a dword offset, reading memory far beyond the allocated property block. The vulnerability affects Linux kernel builds with Thunderbolt/USB4 support enabled.

Critical Impact
An adjacent-network attacker connected via Thunderbolt/USB4 can trigger out-of-bounds memory reads, leading to kernel information disclosure through the device_name and vendor_name sysfs attributes.

Affected Products

Linux kernel with Thunderbolt subsystem enabled (drivers/thunderbolt/property.c)
Systems exposing XDomain connections over Thunderbolt/USB4 interfaces
Multiple stable Linux kernel branches (see referenced kernel commits)

Discovery Timeline

2026-07-19 - CVE-2026-63893 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63893

Vulnerability Analysis

The vulnerability is an integer overflow [CWE-190] in the Thunderbolt property block validator. The function tb_property_entry_valid() computes entry->value + entry->length in u32 arithmetic to verify the entry fits within block_len. Because entry->value is u32 and entry->length is u16, an attacker choosing value = 0xffffff00 and length = 0x100 produces the sum 0x100000000, which wraps to 0. The wrapped result passes the size check, allowing invalid entries to reach the parser.

After the bounds check is bypassed, tb_property_parse() treats entry->value as a dword index into the property block and calls parse_dwdata(). This reads memory located far past the original allocation. TEXT-typed entries with the deviceid or vendorid keys end up in xd->device_name and xd->vendor_name. Those fields are exposed to userspace through per-XDomain sysfs attributes.

The resulting leak is NUL-bounded because kstrdup() stops at the first zero byte, and it is untargeted since the attacker chooses only a delta rather than an absolute address. DATA-typed entries are parsed into property->value.data but are not surfaced to userspace through generic interfaces.

Root Cause

The root cause is missing overflow checking during arithmetic on attacker-controlled fields inside the XDomain property block. The fix replaces the raw addition with check_add_overflow(), which rejects any entry whose value + length wraps in u32.

Attack Vector

Exploitation requires an adjacent-network position, specifically a malicious peer connected over a Thunderbolt or USB4 XDomain link. The attacker crafts a property block containing an entry with an oversized value and length combination that wraps to zero. No authentication or user interaction is required beyond establishing the XDomain connection. Reading back device_name or vendor_name from sysfs returns kernel memory contents that were located at the attacker-chosen offset from the property allocation.

No public proof-of-concept code has been released. Technical details are available in the referenced kernel commits, including commit a47784aee77f and commit 01deda015206.

Detection Methods for CVE-2026-63893

Indicators of Compromise

Unexpected values populating the device_name or vendor_name sysfs attributes of an XDomain device (for example /sys/bus/thunderbolt/devices/*/device_name).
Untrusted Thunderbolt or USB4 devices connecting to hosts before authorization prompts are handled.
Kernel log entries from the thunderbolt subsystem referencing malformed XDomain property blocks.

Detection Strategies

Monitor kernel messages (dmesg, journalctl -k) for Thunderbolt property parsing errors or unusual XDomain enumeration events.
Audit the Thunderbolt device authorization state and alert when devices are auto-approved outside of expected workflows.
Compare running kernel versions against the fixed stable branches referenced in the Linux kernel stable tree.

Monitoring Recommendations

Track physical connection events for Thunderbolt/USB4 ports through endpoint telemetry and correlate against user activity.
Alert on reads of device_name/vendor_name attributes by processes that do not normally query Thunderbolt topology.
Enforce inventory checks on kernel package versions across the Linux fleet to confirm patched builds are deployed.

How to Mitigate CVE-2026-63893

Immediate Actions Required

Update to a Linux kernel release that includes the check_add_overflow() fix in drivers/thunderbolt/property.c.
Disable Thunderbolt device auto-authorization and require explicit user approval for new XDomain peers.
Restrict physical access to Thunderbolt and USB4 ports on unattended systems, particularly laptops in shared spaces.

Patch Information

The fix replaces the vulnerable addition in tb_property_entry_valid() with check_add_overflow() so that any wrapped sum is rejected before it can pass the block_len comparison. Patches are available in multiple stable branches through the Linux kernel stable tree, including commits a47784aee77f, 01deda015206, 31b98e503ecc, 5c06a3043ad9, 6a6362362163, 8d4a758b407a, 9fee50c4e1e4, and e8a0b0a93a6e.

Workarounds

Set the Thunderbolt security level to user or secure in system firmware so that XDomain connections require explicit approval.
Where Thunderbolt/USB4 is not required, disable the thunderbolt kernel module or blacklist it via modprobe.
Use kernel lockdown or IOMMU-based DMA protection to reduce the impact of untrusted peripherals until the patch is deployed.

bash

# Configuration example: prevent thunderbolt module from loading
echo 'blacklist thunderbolt' | sudo tee /etc/modprobe.d/disable-thunderbolt.conf
sudo update-initramfs -u

# Or set authorization policy to require manual approval
echo 0 | sudo tee /sys/bus/thunderbolt/devices/*/authorized