CVE-2026-63893

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer wrap occurs in the tb property entry valid() function when calculating the sum of entry->value (u32) and entry->length (u16). A malicious XDomain peer can provide specific values that cause the sum to wrap to zero, bypassing the block len check. Subsequently, tb property parse() passes entry->value to parse dwdata() as a dword offset, allowing the reading of memory beyond the allocated property block. For TEXT-typed entries with deviceid or vendorid keys, this information can be leaked via the device name or vendor name sysfs attributes. The leak is NUL-bounded and untargeted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.