CVE-2026-63891

Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A crafted peer that chains DIRECTORY entries into a back-reference loop drives the parser until the kernel stack is exhausted and the guard page fires. Any untrusted XDomain peer (cable, dock, in-line inspector, adjacent host) that reaches the PROPERTIES_REQUEST control-plane exchange can trigger this without authentication. Thread a depth counter through tb_property_parse() and __tb_property_parse_dir(), and reject blocks that exceed TB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any observed legitimate XDomain layout. Operators who do not need XDomain host-to-host discovery can disable the path entirely with thunderbolt.xdomain=0 on the kernel command line.

Is your site exposed to CVE-2026-63891?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0026

Probability of exploitation

0.18%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/0a84ab9271936c11e84e511bb52fc5682f8b6726 https://git.kernel.org/stable/c/2b5f47a710172c962ef42d1b732b04d2ad0dce21 https://git.kernel.org/stable/c/830c8a9b467e7d3a158483d37fa7dc13892b293a https://git.kernel.org/stable/c/928abe19fbf0127003abcb1ea69cabc1c897d0ab https://git.kernel.org/stable/c/95839a67ea56ca35732aad7f711404a3127cfe2d https://git.kernel.org/stable/c/b4621e5ef63405c317a84b711faf3bd75b3c6a94 https://git.kernel.org/stable/c/ed9455ef4bd9babc90f92e526abe3fb68c1a8709 https://git.kernel.org/stable/c/f31c6d220f455b5af63590302b30e1b932d14599

Frequently Asked Questions

What is CVE-2026-63891? +

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A crafted peer that chains DIRECTORY entries into a back-reference loop drives the parser until the kernel stack is exhausted and the guard page fires. Any untrusted XDomain peer (cable, dock, in-line inspector, adjacent host) that reaches the PROPERTIES_REQUEST control-plane exchange can trigger this without authentication. Thread a depth counter through tb_property_parse() and __tb_property_parse_dir(), and reject blocks that exceed TB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any observed legitimate XDomain layout. Operators who do not need XDomain host-to-host discovery can disable the path entirely with thunderbolt.xdomain=0 on the kernel command line.

How do I check if I'm vulnerable to CVE-2026-63891? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.