827 matches found
CVE-2026-63893
A flaw was found in the Linux kernel's Thunderbolt property handling. A remote attacker, by acting as a malicious XDomain peer, could craft a special property entry that causes an integer overflow when calculating memory access. This overflow allows the system to read memory outside of the intend...
CVE-2026-63892
A flaw was found in the Linux kernel's Thunderbolt property driver. When processing Thunderbolt properties on a non-root path, a crafted entry with a small entry-length value can lead to an out-of-bounds read. This occurs because the kmemdup function reads beyond the intended memory block and a...
CVE-2026-63891
A flaw was found in the Linux kernel's Thunderbolt property parsing. An untrusted Thunderbolt peer, such as a cable or dock, can send specially crafted property requests that create a recursive loop. This can lead to kernel stack exhaustion, resulting in a system crash and a Denial of Service DoS...
SUSE CVE-2026-63891
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...
SUSE CVE-2026-63892
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...
SUSE CVE-2026-63893
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tbpropertyentryvalid entry-value is u32 and entry-length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum...
Linux Distros Unpatched Vulnerability : CVE-2026-63893
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: property: Reject u32 wrap in tbpropertyentryvalid entry-value is u32 and entry-length is u16; the sum is performed in u32 and wraps. A malicious...
Linux Distros Unpatched Vulnerability : CVE-2026-63891
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into...
Linux Distros Unpatched Vulnerability : CVE-2026-63892
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords fro...
CVE-2026-63892
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...
CVE-2026-63891
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...
CVE-2026-63893
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tbpropertyentryvalid entry-value is u32 and entry-length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum...
CVE-2026-63893
The connected documents describe a Linux kernel vulnerability in thunderbolt property parsing: a wrap of the 32-bit sum (entry->value + entry->length) allows an attacker-controlled offset to read memory beyond the property block. The root cause is not validating the sum with overflow checks...
CVE-2026-63893 thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tbpropertyentryvalid entry-value is u32 and entry-length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum...
EUVD-2026-45666
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tbpropertyentryvalid entry-value is u32 and entry-length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum...
CVE-2026-63893
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tbpropertyentryvalid entry-value is u32 and entry-length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum...
CVE-2026-63893 thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tbpropertyentryvalid entry-value is u32 and entry-length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum...
CVE-2026-63892 thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...
EUVD-2026-45665
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...
CVE-2026-63892
CVE-2026-63892 affects the Linux kernel thunderbolt property parsing. The non-root path in __tb_property_parse_dir() may read beyond the end of a property block when entry->length length and the code copies 4 dwords from dir_offset regardless of dir_len. This creates two OOB conditions: (1) a ...