CVE-2026-63891

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()

A DIRECTORY entry's value field is used as the dir_offset for a

recursive call into __tb_property_parse_dir() with no depth counter.

A crafted peer that chains DIRECTORY entries into a back-reference

loop drives the parser until the kernel stack is exhausted and the

guard page fires. Any untrusted XDomain peer (cable, dock, in-line

inspector, adjacent host) that reaches the PROPERTIES_REQUEST

control-plane exchange can trigger this without authentication.

Thread a depth counter through tb_property_parse() and

__tb_property_parse_dir(), and reject blocks that exceed

TB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any

observed legitimate XDomain layout.

Operators who do not need XDomain host-to-host discovery can disable

the path entirely with thunderbolt.xdomain=0 on the kernel command

line.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References