CVE-2026-63892

A flaw was found in the Linux kernel's Thunderbolt property driver. When processing Thunderbolt properties on a non-root path, a crafted entry with a small entry->length value can lead to an out-of-bounds read. This occurs because the kmemdup function reads beyond the intended memory block and a size_t underflow causes further out-of-bounds memory access during entry processing. This vulnerability can allow a local attacker to cause a kernel crash, resulting in a denial of service.

A Thunderbolt property directory parsing bug can occur when a non root directory entry advertises dir_len below 4. The parser may copy a fixed size UUID from near the end of the property block and then compute content_len as dir_len minus 4, causing size_t underflow and an oversized entry walk. This can lead to out of bounds kernel reads and a kernel crash when a crafted Thunderbolt or USB4 peer device supplies malformed XDomain property data. For the CVSS the PR:N because the attacker does not need a local account on the target, but must be able to connect or control the relevant Thunderbolt or USB4 peer device. The issue is not Internet reachable and is best modeled as physical access to a peripheral path. Impact is at least denial of service. For the paranoid score, limited confidentiality or integrity impact is kept because the primitive is OOB read and parser state confusion, but no direct OOB write or arbitrary write primitive is evident.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.