SB20261022291 - Incomplete cleanup in Linux kernel thunderbolt driver

Description

This security bulletin contains information about 1 vulnerability.

1) Incomplete cleanup (CVE-ID: CVE-2026-98691)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a temporary denial of service by delaying Thunderbolt domain unbinding until the DPRX timeout expires.

The vulnerability exists due to incomplete cleanup of inactive DisplayPort tunnels in tb_stop() in drivers/thunderbolt/tb.c when stopping a Thunderbolt domain with pending dprx_work. A local user can potentially trigger domain teardown while this work is pending to leave a callback running against an already torn-down domain, retaining a domain reference and blocking unbinding until the timeout expires.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0b457c6733f73421a3fb03786f13d67c618b5119
• https://git.kernel.org/stable/c/34a6e27c954e5bfc29fead17867c7155d54b6481
• https://git.kernel.org/stable/c/cbd2abb85ea32cafdcbaba218e13b18d8ed79bfa