Skip to main content

Linux Kernel EUVDEUVD-2026-45666

| CVE-2026-63893 HIGH
2026-07-19 Linux GHSA-x965-jq5m-mrm4
Information Disclosure Linux
8.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.1 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Requires adjacent Thunderbolt XDomain peer (AV:A) with no auth (PR:N); primary impact is kernel memory disclosure (C:H), OOB read may crash but availability is only plausible (A:L), no integrity impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 16:11 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.1 (HIGH)
Patch available
Jul 19, 2026 - 17:19 EUVD
CVE Published
Jul 19, 2026 - 14:55 cve.org
HIGH 8.1
CVE Published
Jul 19, 2026 - 14:55 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()

entry->value is u32 and entry->length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum 0x100000000 wraps to 0 and passes the > block_len check. tb_property_parse() then passes entry->value to parse_dwdata() as a dword offset into the property block, reading attacker-directed memory far past the allocation.

For TEXT-typed entries with the "deviceid" or "vendorid" keys this lands in xd->device_name / xd->vendor_name and is readable back via the per-XDomain device_name / vendor_name sysfs attributes; the leak is NUL-bounded (kstrdup() stops at the first zero byte) and untargeted (the attacker picks a delta, not an absolute address). DATA-typed entries are parsed into property->value.data but not generically surfaced to userspace.

Use check_add_overflow() so a wrapped sum is rejected.

AnalysisAI

Out-of-bounds kernel memory read in the Linux kernel Thunderbolt (thunderbolt) driver's XDomain property parser lets a malicious directly-connected Thunderbolt/USB4 peer leak kernel memory contents. The flaw stems from a u32 integer wrap in tb_property_entry_valid(), where a crafted property entry (value=0xffffff00, length=0x100) wraps the bounds check and causes tb_property_parse() to read attacker-directed memory far past the property block allocation; leaked bytes for TEXT-typed 'deviceid'/'vendorid' keys become readable via the per-XDomain device_name/vendor_name sysfs attributes. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and EPSS is low (0.21%), consistent with a physical-access adjacent-only information-disclosure bug.

Technical ContextAI

Thunderbolt/USB4 supports XDomain connections, a peer-to-peer protocol allowing two hosts connected over a Thunderbolt cable to exchange property directories (name/value metadata blocks). The kernel's drivers/thunderbolt property parser validates each entry with tb_property_entry_valid() before dereferencing offsets. Each entry carries a u32 'value' (used as a dword offset into the property block) and a u16 'length'; the validity check compares their sum against the block length. Because the addition is computed in u32 arithmetic, a sufficiently large value+length overflows 2^32 and wraps to a small number, defeating the > block_len bound. tb_property_parse() then feeds the unvalidated value into parse_dwdata() as a dword index, producing an out-of-bounds read. This is a classic CWE-190 (integer overflow/wraparound) leading to CWE-125 (out-of-bounds read); the CWE field was not populated in the source data. The fix replaces the raw addition with check_add_overflow() so any wrapping sum is rejected.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux stable release for your branch - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, or 6.18.35 (or later mainline), which replace the vulnerable addition with check_add_overflow() in tb_property_entry_valid(). Apply your distribution's corresponding kernel update, since distros backport these stable commits; the authoritative fix commits are at https://git.kernel.org/stable/c/6a63623621639acbb39bc2d9fb09559681716695 and the other stable-tree links, and the tracking record is at https://nvd.nist.gov/vuln/detail/CVE-2026-63893. Where patching must be deferred, the most effective compensating control is to eliminate the attack surface: disable Thunderbolt/USB4 in firmware/BIOS if not needed, or set the kernel Thunderbolt security level to 'dponly' or 'nopcie'/user authorization mode (boltd/bolt) so untrusted peers cannot establish XDomain sessions - the trade-off is loss of Thunderbolt peripheral/networking functionality. Physically restricting access to Thunderbolt ports (port blockers, policy against connecting untrusted docks/hosts) reduces exposure for shared or public machines, at the cost of user convenience.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45666 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy