{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-63892 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-63892 is a vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-63892 and fix it if it is affected.\n\nWhat it is: CVE-2026-63892 is a vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-63892 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-63892/ (Markdown: https://insights.sbomify.com/CVE-2026-63892/index.md)","id":"CVE-2026-63892","markdown":"https://insights.sbomify.com/CVE-2026-63892/index.md","name":"CVE-2026-63892","record":{"aliases":["BELL-CVE-2026-63892","DEBIAN-CVE-2026-63892","GHSA-c25w-638m-wrp7","ROOT-OS-UBUNTU-2204-CVE-2026-63892","UBUNTU-CVE-2026-63892"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"A size_t underflow in the Linux kernel Thunderbolt driver allows out-of-bounds reads and potential kernel crashes via crafted property entries.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow\n\nOn the non-root path, __tb_property_parse_dir() takes dir_len from\nentry-\u003elength (u16 widened to size_t).  Two distinct OOB conditions\nfollow when entry-\u003elength \u003c 4:\n\n1. The non-root path begins with kmemdup(\u0026block[dir_offset],\n   sizeof(*dir-\u003euuid), ...) which always reads 4 dwords from\n   dir_offset.  tb_property_entry_valid() only enforces\n   dir_offset + entry-\u003elength \u003c= block_len, so a crafted entry\n   with dir_offset close to the end of the property block and\n   entry-\u003elength in 0..3 passes that gate but lets the UUID copy\n   run off the block (e.g. dir_offset = 497, dir_len = 3 in a\n   500-dword block reads block[497..501]).\n\n2. After the kmemdup, content_len = dir_len - 4 underflows size_t\n   to ~SIZE_MAX, nentries becomes SIZE_MAX / 4, and the entry\n   walk runs OOB on each iteration until an entry fails\n   validation or the kernel oopses on an unmapped page.\n\nReject dir_len \u003c 4 on the non-root path *before* the UUID kmemdup,\nwhich closes both holes.\n\nAlso move INIT_LIST_HEAD(\u0026dir-\u003eproperties) up to immediately after\nthe dir allocation so the new error-return path (and the existing\nuuid-alloc failure path) calling tb_property_free_dir() sees a\nwalkable list rather than the zero-initialized NULL next/prev that\nlist_for_each_entry_safe() would oops on.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow","id":"CVE-2026-63892","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()","id":"CVE-2026-63893"},"packages":[],"prev":{"headline":"thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()","id":"CVE-2026-63891"},"products":["Linux"],"published":"2026-07-19","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-07-19","vendors":["Linux"]},"summary":"A size_t underflow in the Linux kernel Thunderbolt driver allows out-of-bounds reads and potential kernel crashes via crafted property entries.","url":"https://insights.sbomify.com/CVE-2026-63892/"}