CVE-2026-63891 thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
A crafted Thunderbolt peer can cause a kernel stack overflow via infinite recursion in property parsing, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63891?
CVE-2026-63891 is a denial of service vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A crafted peer that chains DIRECTORY entries into a back-reference loop drives the parser until the kernel stack is exhausted and the guard page fires. Any untrusted XDomain peer (cable, dock, in-line inspector, adjacent host) that reaches the PROPERTIES_REQUEST control-plane exchange can trigger this without authentication.
Thread a depth counter through tb_property_parse() and __tb_property_parse_dir(), and reject blocks that exceed TB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any observed legitimate XDomain layout.
Operators who do not need XDomain host-to-host discovery can disable the path entirely with thunderbolt.xdomain=0 on the kernel command line.
Which versions are affected by CVE-2026-63891?
How do I fix CVE-2026-63891?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-63891 being exploited?
There is no known exploitation of CVE-2026-63891 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-63891, DEBIAN-CVE-2026-63891, GHSA-67r4-fvhf-7vqf, ROOT-OS-UBUNTU-2204-CVE-2026-63891, UBUNTU-CVE-2026-63891.