SB20260912385 - Incomplete Internal State Distinction in Linux kernel net thunderbolt driver

Description

This security bulletin contains information about 1 vulnerability.

1) Incomplete Internal State Distinction (CVE-ID: CVE-2026-80989)

CWE-ID: CWE-372 - Incomplete Internal State Distinction

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper connection state management in tbnet_connected_work() when handling a failed connection setup followed by connection teardown. A remote attacker can trigger a failed connection setup followed by connection teardown to cause a denial of service.

When panic_on_warn is enabled, stopping already stopped rings can be fatal.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3c8b26ebf525ba5960510f48c6e9936a79ebe76f
• https://git.kernel.org/stable/c/d6c0af293129345a17dc31c9b4179dc7f3d6af7a
• https://git.kernel.org/stable/c/ed1d6e3d735e7b03f43a02f4306c89eb7663da14
• https://git.kernel.org/stable/c/f01e6a35c440b62f060e21f36b385e574a7f308c