CVE-2026-63893

A flaw was found in the Linux kernel's Thunderbolt property handling. A remote attacker, by acting as a malicious XDomain peer, could craft a special property entry that causes an integer overflow when calculating memory access. This overflow allows the system to read memory outside of the intend...

SUSE CVE-2026-63891

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...

Linux Distros Unpatched Vulnerability : CVE-2026-63891

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into...

CVE-2026-63891

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...

CVE-2026-63893

The connected documents describe a Linux kernel vulnerability in thunderbolt property parsing: a wrap of the 32-bit sum (entry->value + entry->length) allows an attacker-controlled offset to read memory beyond the property block. The root cause is not validating the sum with overflow checks...

CVE-2026-63891 thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...

CVE-2026-63891

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...

CVE-2026-63891 thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...

CVE-2026-63891

The CVE affects the Linux kernel Thunderbolt property parser. A crafted peer can trigger a back‑reference loop in DIRECTORY entries, exhausting stack via __tb_property_parse_dir() because the value is used as dir_offset without a depth counter. The fix threads a depth counter through tb_property_...

PT-2026-61208

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the thunderbolt component where the tb property parse dir function lacks a recursion depth counter when processing DIRECTORY entries. A malicious XDomain peer can crea...

PT-2026-61210

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer wrap occurs in the tb property entry valid function when calculating the sum of entry-value u32 and entry-length u16. A malicious XDomain peer can provide specific values that...

CVE-2026-53146

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain response copy to actual frame size tbxdomaincopy copies req-responsesize bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the val...

Linux Distros Unpatched Vulnerability : CVE-2026-53147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: Validate XDomain request packet size before type cast tbxdphandlerequest casts the received packet buffer to protocol-specific structs without...

thunderbolt: Clamp XDomain response data copy to allocation size

...

thunderbolt: Limit XDomain response copy to actual frame size

...

CVE-2026-53147

A flaw was found in the Linux kernel's Thunderbolt component. A remote attacker could exploit this vulnerability by sending a malformed XDomain packet. This could lead to an out-of-bounds read, potentially resulting in information disclosure or system instability...

SUSE CVE-2026-53146

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain response copy to actual frame size tbxdomaincopy copies req-responsesize bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the val...

SUSE CVE-2026-53147

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tbxdphandlerequest casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer...

SUSE CVE-2026-53150

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject zero-length property entries in validator tbpropertyentryvalid accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes validation but causes an underflow in the...

CVE-2026-53147

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tbxdphandlerequest casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer...