CVE-2026-98689

Received Received - Intake

Thunderbolt DP Tunnel Access After DPRX Cancellation

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tb_dp_dprx_work() checks ->dprx_canceled before it takes tb->lock so it misses a tb_dp_dprx_stop() that could not cancel the already running work. It then polls the DPRX capabilities and runs the callback for a tunnel that has already been torn down while the domain is suspending or going away. This can be hit by cancelling the DPRX read from outside the ordered tb->wq: During suspend tb_disconnect_and_release_dp() does just this and with a later patch tb_stop() will do it as well. The latter in combination with the Apple NHI where the DPRX read never completed is how I hit this. Check the flag with tb->lock held instead and check it again in tb_dp_tunnel_active() because the callback runs after the lock has been dropped again. Also clear the flag in tb_dp_dprx_start() so that it only ever describes the work that is currently in flight.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98689

EUVD

EUVD-2026-103943

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	d6d458d42e1e1544a18f37f1d5c840e00d5261b9
Linux	Linux	d6d458d42e1e1544a18f37f1d5c840e00d5261b9
Linux	Linux	d6d458d42e1e1544a18f37f1d5c840e00d5261b9
Linux	Linux	6.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the Thunderbolt subsystem. It involves a race condition where a DisplayPort (DP) tunnel's read operation is canceled but the system still tries to access the tunnel after it has been torn down. The issue occurs because the cancellation check happens before locking, allowing a race with the tunnel's stop function during suspend or domain teardown.

Detection Guidance

This vulnerability is specific to the Linux kernel's Thunderbolt subsystem and involves a race condition in DP tunnel handling. Detection requires checking kernel logs for Thunderbolt-related errors or warnings, particularly during suspend/resume cycles or device disconnections. No direct network detection commands are applicable as this is a local system issue.

Impact Analysis

This vulnerability could lead to system instability or crashes when suspending or disconnecting Thunderbolt devices. It may cause kernel panics or unexpected behavior if a DisplayPort tunnel is accessed after it has been canceled and torn down.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level Linux kernel issue related to Thunderbolt DP tunnel management during suspend operations, with no documented impact on data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this Thunderbolt vulnerability. Check your distribution's security advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-98689. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70