Unknown

CVE-2026-63892 — thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow On the non-root path, __tb_property_parse_dir() takes dir_len from entry->length (u16 widened to size_t). Two distinct OOB conditions follow when entry->length < 4: 1. The non-root path begins with kmemdup(&block[dir_offset], sizeof(*dir->uuid), ...) which always reads 4 dwords from dir_offset. tb_property_entry_valid() only enforces dir_offset + entry->length <= block_len, so a crafted entry with dir_offset close to the end of the property block and entry->length in 0..3 passes that gate but lets the UUID copy run off the block (e.g. dir_offset = 497, dir_len = 3 in a 500-dword block reads block[497..501]). 2. After the kmemdup, content_len = dir_len - 4 underflows size_t to ~SIZE_MAX, nentries becomes SIZE_MAX / 4, and the entry walk runs OOB on each iteration until an entry fails validation or the kernel oopses on an unmapped page. Reject dir_len < 4 on the non-root path *before* the UUID kmemdup, which closes both holes. Also move INIT_LIST_HEAD(&dir->properties) up to immediately after the dir allocation so the new error-return path (and the existing uuid-alloc failure path) calling tb_property_free_dir() sees a walkable list rather than the zero-initialized NULL next/prev that list_for_each_entry_safe() would oops on.

Published Jul 19, 2026 · Updated Oct 15, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

No scoring signals.

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

—

No EPSS score.

Affects

Linux

CVSS base

—

Score not published yet.

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
No fix documented in the sources: reduce exposure and monitor the vendor advisory.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Linux	Linux	≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179 and < 37abc4504fa19d8f9f1e87792e8a2b8fdb308e40≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179 and < e2d4d51cf5785815fa4e91e0c019e3eb2506a84c≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179 and < de618299190b418291609e6921557253bd417e25≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179 and < 5506c825f14d810f0690b1f4367cb7249ebb387a≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179 and < 542a13890b742099c461d70920e97b14e568f6ec≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179 and < d548179adcc87e1bc66b17e00352a1f536e76065≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179 and < 3bec49ca55e08fb085cc4318f24b1b37eaab28cb≥ cdae7c07e3e3509eaabc18c1640a55dc5b99c179 and < de21b59c29e31c5108ddc04210631bbfab81b997 and 1 more version 4.15	Vulnerable	CVE Program (cve.org) e CISA ADP

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Not enough vector or weakness data: use the affected application’s logs as a starting point.

application logs

Timeline

What happened to this CVE, newest first.

2026
Record published
Oct 15, 2026
Affected products added · linux/linux
Oct 15, 2026 · CVE Program (cve.org) e CISA ADP
Source status changed · → Awaiting Analysis
Oct 15, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 15, 2026 · NIST National Vulnerability Database
CVE published
Jul 19, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

1× Official description updated · Oct 15, 2026 – Oct 15, 2026

References

8 on the record

git.kernel.org/stable/c/5506c825f14d810f0690b1f4367cb7249ebb387a
NIST National Vulnerability Database
git.kernel.org/stable/c/d548179adcc87e1bc66b17e00352a1f536e76065
NIST National Vulnerability Database
git.kernel.org/stable/c/3bec49ca55e08fb085cc4318f24b1b37eaab28cb
NIST National Vulnerability Database
git.kernel.org/stable/c/37abc4504fa19d8f9f1e87792e8a2b8fdb308e40
NIST National Vulnerability Database
git.kernel.org/stable/c/e2d4d51cf5785815fa4e91e0c019e3eb2506a84c
NIST National Vulnerability Database
git.kernel.org/stable/c/de618299190b418291609e6921557253bd417e25
NIST National Vulnerability Database
git.kernel.org/stable/c/de21b59c29e31c5108ddc04210631bbfab81b997
NIST National Vulnerability Database
git.kernel.org/stable/c/542a13890b742099c461d70920e97b14e568f6ec
NIST National Vulnerability Database

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

Critical CVE-2026-99999 ipv4: validate checksum_start before completing checksum 13h
Unknown CVE-2026-98432 ipv4: free inet_opt and ireq_opt after an RCU grace period 13h
Unknown CVE-2026-98426 wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path 1d
Unknown CVE-2026-98427 net/sched: codel: bound the dropping loop per dequeue call 1d
Unknown CVE-2026-98428 ALSA: usb: 6fire: Avoid embedded URBs 1d
Unknown CVE-2026-98429 RDMA/efa: Keep EQ resources alive while IRQ is registered 1d

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No CVSS score published by NVD, the CNA, CISA or GitHub so far.
No FIRST EPSS score.
No fixed version, patch or mitigation documented.
No CISA SSVC assessment.
No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-63892 is "thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.