CVE-2026-63893
CVE CVE-2026-63893EUVD EUVD-2026-45666Published 2026-07-19T14:55:04.000ZLast changed 2026-08-05T12:36:59.000ZCVSS 8.1
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() entry->value is u32 and entry->length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum 0x100000000 wraps to 0 and passes the > block_len check. tb_property_parse() then passes entry->value to parse_dwdata() as a dword offset into the property block, reading attacker-directed memory far past the allocation. For TEXT-typed entries with the "deviceid" or "vendorid" keys this lands in xd->device_name / xd->vendor_name and is readable back via the per-XDomain device_name / vendor_name sysfs attributes; the leak is NUL-bounded (kstrdup() stops at the first zero byte) and untargeted (the attacker picks a delta, not an absolute address). DATA-typed entries are parsed into property->value.data but not generically surfaced to userspace. Use check_add_overflow() so a wrapped sum is rejected.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux cdae7c07e3e3509eaabc18c1640a55dc5b99c179 <6a63623621639acbb39bc2d9fb09559681716695; cdae7c07e3e3509eaabc18c1640a55dc5b99c179 <8d4a758b407ab3de3be86d1ceadfa35d717d30c7; cdae7c07e3e3509eaabc18c1640a55dc5b99c179 <a47784aee77f33f786dc5d7375db821bdae68792; patch: 7.0.12; patch: 7.1; cdae7c07e3e3509eaabc18c1640a55dc5b99c179 <5c06a3043ad944f087bb2ae0aae28d820bb9f460; cdae7c07e3e3509eaabc18c1640a55dc5b99c179 <01deda0152066c6c955f0619114ea6afa070aaec; patch: 6.6.143; patch: 6.18.35; cdae7c07e3e3509eaabc18c1640a55dc5b99c179 <9fee50c4e1e42f6d3cbe30df584f9f648f626071; cdae7c07e3e3509eaabc18c1640a55dc5b99c179 <31b98e503ecca8077e5247253dd5425ab84bc96d; patch: 0; patch: 5.10.259; 4.15; patch: 6.1.176; patch: 5.15.210; patch: 6.12.93; cdae7c07e3e3509eaabc18c1640a55dc5b99c179 <e8a0b0a93a6ef958e70b1dd4930beb6dc0026b36
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.