CVE-2026-63892

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow

On the non-root path, __tb_property_parse_dir() takes dir_len from

entry->length (u16 widened to size_t). Two distinct OOB conditions

follow when entry->length < 4:

1. The non-root path begins with kmemdup(&block[dir_offset],

sizeof(*dir->uuid), ...) which always reads 4 dwords from

dir_offset. tb_property_entry_valid() only enforces

dir_offset + entry->length <= block_len, so a crafted entry

with dir_offset close to the end of the property block and

entry->length in 0..3 passes that gate but lets the UUID copy

run off the block (e.g. dir_offset = 497, dir_len = 3 in a

500-dword block reads block[497..501]).

2. After the kmemdup, content_len = dir_len - 4 underflows size_t

to ~SIZE_MAX, nentries becomes SIZE_MAX / 4, and the entry

walk runs OOB on each iteration until an entry fails

validation or the kernel oopses

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References