# CVE-2026-63892: thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow

> A size_t underflow in the Linux kernel Thunderbolt driver allows out-of-bounds reads and potential kernel crashes via crafted property entries.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 19 Jul 2026
- **Updated:** 19 Jul 2026
- **Also known as:** BELL-CVE-2026-63892, DEBIAN-CVE-2026-63892, GHSA-c25w-638m-wrp7, ROOT-OS-UBUNTU-2204-CVE-2026-63892, UBUNTU-CVE-2026-63892

## What is CVE-2026-63892?

CVE-2026-63892 is a vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow

On the non-root path, __tb_property_parse_dir() takes dir_len from
entry->length (u16 widened to size_t).  Two distinct OOB conditions
follow when entry->length < 4:

1. The non-root path begins with kmemdup(&block[dir_offset],
   sizeof(*dir->uuid), ...) which always reads 4 dwords from
   dir_offset.  tb_property_entry_valid() only enforces
   dir_offset + entry->length <= block_len, so a crafted entry
   with dir_offset close to the end of the property block and
   entry->length in 0..3 passes that gate but lets the UUID copy
   run off the block (e.g. dir_offset = 497, dir_len = 3 in a
   500-dword block reads block[497..501]).

2. After the kmemdup, content_len = dir_len - 4 underflows size_t
   to ~SIZE_MAX, nentries becomes SIZE_MAX / 4, and the entry
   walk runs OOB on each iteration until an entry fails
   validation or the kernel oopses on an unmapped page.

Reject dir_len < 4 on the non-root path *before* the UUID kmemdup,
which closes both holes.

Also move INIT_LIST_HEAD(&dir->properties) up to immediately after
the dir allocation so the new error-return path (and the existing
uuid-alloc failure path) calling tb_property_free_dir() sees a
walkable list rather than the zero-initialized NULL next/prev that
list_for_each_entry_safe() would oops on.

## Which versions are affected by CVE-2026-63892?


## How do I fix CVE-2026-63892?

Apply the vendor's patch.

## Is CVE-2026-63892 being exploited?

There is no known exploitation of CVE-2026-63892 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-63892 and fix it if it is affected.

What it is: CVE-2026-63892 is a vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-63892 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-63892/ (Markdown: https://insights.sbomify.com/CVE-2026-63892/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-63892
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63892
- OSV: https://osv.dev/vulnerability/CVE-2026-63892

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-63892/
Summaries are generated and may contain mistakes; the official description above is the record.