CVE-2026-63893

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()

entry->value is u32 and entry->length is u16; the sum is performed in

u32 and wraps. A malicious XDomain peer can pick

value = 0xffffff00, length = 0x100 so the sum 0x100000000 wraps to 0

and passes the > block_len check. tb_property_parse() then passes

entry->value to parse_dwdata() as a dword offset into the property

block, reading attacker-directed memory far past the allocation.

For TEXT-typed entries with the "deviceid" or "vendorid" keys this

lands in xd->device_name / xd->vendor_name and is readable back via

the per-XDomain device_name / vendor_name sysfs attributes; the leak

is NUL-bounded (kstrdup() stops at the first zero byte) and

untargeted (the attacker picks a delta, not an absolute address).

DATA-typed entries are parsed into property->value.data but not

generically surfaced to userspace.

Use check_add_overflow() so a wrapped sum i

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References