PT-2026-61208 · Linux · Linux
CVE-2026-63891
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: property: Cap recursion depth in tb property parse dir()
A DIRECTORY entry's value field is used as the dir offset for a
recursive call into tb property parse dir() with no depth counter.
A crafted peer that chains DIRECTORY entries into a back-reference
loop drives the parser until the kernel stack is exhausted and the
guard page fires. Any untrusted XDomain peer (cable, dock, in-line
inspector, adjacent host) that reaches the PROPERTIES REQUEST
control-plane exchange can trigger this without authentication.
Thread a depth counter through tb property parse() and
tb property parse dir(), and reject blocks that exceed
TB PROPERTY MAX DEPTH = 8. That is comfortably larger than any
observed legitimate XDomain layout.
Operators who do not need XDomain host-to-host discovery can disable
the path entirely with thunderbolt.xdomain=0 on the kernel command
line.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux