CVE-2026-89737

Received Received - Intake

USB Type-C Thunderbolt Work Queue Use-After-Free in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: thunderbolt: Disable work before freeing tbt on remove tbt_altmode_remove() drops the plug and cable references without draining tbt->work. The work function dereferences those references, and can also requeue itself in its error path. The VDM callbacks can queue the same work item. Disable and drain tbt->work before dropping the references. This waits for an existing invocation and prevents subsequent schedule_work() calls from queueing it during teardown. This issue was found by an in-house static analysis tool and confirmed by manual code review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89737

EUVD

EUVD-2026-76649

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the USB Type-C Thunderbolt driver. When the device is removed, the function tbt_altmode_remove() drops references to the plug and cable without properly stopping or draining the work queue (tbt->work). The work function may still try to access these freed references, leading to potential crashes or undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB Type-C Thunderbolt subsystem. Detection requires checking kernel logs for Thunderbolt-related errors or crashes during device removal. Use commands like 'dmesg | grep -i thunderbolt' or 'journalctl -k | grep -i thunderbolt' to inspect logs for related issues.

Impact Analysis

If exploited, this could cause system instability, crashes, or unexpected behavior when removing a Thunderbolt device. It may also lead to data corruption or security issues if the work function executes after resources are freed.

Mitigation Strategies

Update your Linux kernel to the latest stable version where this issue is patched. If immediate patching is not possible, avoid unplugging Thunderbolt devices while the system is in use to reduce exposure.

Hi! I’m here to help you understand CVE-2026-89737. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70