CVE-2026-63891 thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()

🗓️ 19 Jul 2026 14:55:02Reported by LinuxType

Thunderbolt property parser depth capped at eight to prevent stack exhaustion from untrusted xdomain peers.

Reporter	Title	Published	Views	Family All 21
CVE	CVE-2026-63891	19 Jul 202614:55	–	cve
Debian CVE	CVE-2026-63891	19 Jul 202614:55	–	debiancve
EUVD	EUVD-2026-45664	19 Jul 202614:55	–	euvd
NVD	CVE-2026-63891	19 Jul 202616:17	–	nvd
OSV	BELL-CVE-2026-63891	22 Jul 202606:04	–	osv
OSV	DEBIAN-CVE-2026-63891	19 Jul 202616:17	–	osv
OSV	ROOT-OS-UBUNTU-2204-CVE-2026-63891 CVE-2026-63891 in linux - Patched by Root	6 Aug 202607:51	–	osv
OSV	UBUNTU-CVE-2026-63891	20 Jul 202600:00	–	osv
OSV	USN-8593-1 linux-ibm, linux-oracle vulnerabilities	23 Jul 202607:35	–	osv
OSV	USN-8603-1 linux-azure, linux-azure-fde vulnerabilities	24 Jul 202609:51	–	osv

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/thunderbolt/property.c"
    ],
    "versions": [
      {
        "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
        "lessThan": "2b5f47a710172c962ef42d1b732b04d2ad0dce21",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
        "lessThan": "95839a67ea56ca35732aad7f711404a3127cfe2d",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
        "lessThan": "0a84ab9271936c11e84e511bb52fc5682f8b6726",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
        "lessThan": "b4621e5ef63405c317a84b711faf3bd75b3c6a94",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
        "lessThan": "f31c6d220f455b5af63590302b30e1b932d14599",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
        "lessThan": "830c8a9b467e7d3a158483d37fa7dc13892b293a",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
        "lessThan": "ed9455ef4bd9babc90f92e526abe3fb68c1a8709",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
        "lessThan": "928abe19fbf0127003abcb1ea69cabc1c897d0ab",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/thunderbolt/property.c"
    ],
    "versions": [
      {
        "version": "4.15",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "4.15",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.10.259",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.15.210",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.1.176",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.143",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.93",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.35",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.0.12",
        "lessThanOrEqual": "7.0.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.1",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

Source	Link
git	www.git.kernel.org/stable/c/830c8a9b467e7d3a158483d37fa7dc13892b293a
git	www.git.kernel.org/stable/c/928abe19fbf0127003abcb1ea69cabc1c897d0ab
git	www.git.kernel.org/stable/c/ed9455ef4bd9babc90f92e526abe3fb68c1a8709
git	www.git.kernel.org/stable/c/0a84ab9271936c11e84e511bb52fc5682f8b6726
git	www.git.kernel.org/stable/c/b4621e5ef63405c317a84b711faf3bd75b3c6a94
git	www.git.kernel.org/stable/c/f31c6d220f455b5af63590302b30e1b932d14599
git	www.git.kernel.org/stable/c/95839a67ea56ca35732aad7f711404a3127cfe2d
git	www.git.kernel.org/stable/c/2b5f47a710172c962ef42d1b732b04d2ad0dce21

19 Jul 2026 14:55Current

EPSS0.00263