Uncontrolled Recursion in Linux kernel - CVE-2026-63891
Published: July 20, 2026
Vulnerability identifier: #VU138758
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-63891
CWE-ID: CWE-674
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in __tb_property_parse_dir() in the thunderbolt property parser when processing a crafted PROPERTIES_REQUEST control-plane exchange containing chained DIRECTORY entries with a back-reference loop. A remote attacker can send crafted XDomain property data to cause a denial of service.
The issue can be triggered by an untrusted XDomain peer such as a cable, dock, in-line inspector, or adjacent host.
How to mitigate CVE-2026-63891
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/0a84ab9271936c11e84e511bb52fc5682f8b6726
- https://git.kernel.org/stable/c/2b5f47a710172c962ef42d1b732b04d2ad0dce21
- https://git.kernel.org/stable/c/830c8a9b467e7d3a158483d37fa7dc13892b293a
- https://git.kernel.org/stable/c/928abe19fbf0127003abcb1ea69cabc1c897d0ab
- https://git.kernel.org/stable/c/95839a67ea56ca35732aad7f711404a3127cfe2d
- https://git.kernel.org/stable/c/b4621e5ef63405c317a84b711faf3bd75b3c6a94
- https://git.kernel.org/stable/c/ed9455ef4bd9babc90f92e526abe3fb68c1a8709
- https://git.kernel.org/stable/c/f31c6d220f455b5af63590302b30e1b932d14599