SB20261022289 - Improper update of reference count in Linux kernel thunderbolt driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper update of reference count (CVE-ID: CVE-2026-98690)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by making Thunderbolt driver unbinding wait indefinitely.

The vulnerability exists due to improper reference counting in the Linux kernel Thunderbolt DisplayPort tunnel handling when pending DPRX read work is canceled without releasing its domain reference. A local privileged user can trigger DisplayPort tunnel teardown before the DPRX read completes, such as by unplugging within the timeout, and subsequently unbind the driver to cause an indefinite wait for domain release.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1fd1f67c94d30889377bba774f032ec15e8b9299
• https://git.kernel.org/stable/c/2f5893172fc6153f5f1ef34014ddbfcbf1f47f29
• https://git.kernel.org/stable/c/7739b02129b2248f9a8054cfda924fa253f66a88