CVE-2026-98688
Received Received - Intake

NULL Pointer Dereference in Linux Kernel Thunderbolt

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tb_remove_work() There is a slight race between tb_remove_work() and tb_domain_remove() which leads to dereferencing a NULL tb->root_switch pointer inside tb_free_unplugged_xdomains(): Thread A Thread B tb_remove_work() tb_domain_remove() mutex_lock(&tb->lock) tb_stop() /* doesn't cancel a running callback */ cancel_delayed_work(&tcm->remove_work) ... tb_switch_remove(tb->root_switch) tb->root_switch = NULL mutex_unlock(&tb->lock) mutex_lock(&tb->lock) ... /* without checking ->root_switch */ tb_free_unplugged_xdomains(tb->root_switch) mutex_unlock(&tb->lock) Commit a8937f35cf39 ("thunderbolt: Remove XDomain from the bus without holding tb->lock") doesn't seem right to move tb_free_unplugged_xdomains() out of the &tb->lock section and the check for tb->root_switch, in particular. It states: For this reason separate removing the XDomain from the topology data structures (where we need the lock) from unregistering the device from the bus (where remove callbacks of the drivers are being called). tb_free_unplugged_xdomains() belongs to the former group of functions requiring the lock. And it also calls tb_xdomain_remove() which should only be called with &tb->lock held. Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98688
EUVD
EUVD-2026-103942

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
Linux Linux a8937f35cf39c39c64325aa84d0463d866850857
Linux Linux a8937f35cf39c39c64325aa84d0463d866850857
Linux Linux 3e9e823810b9a51f0bee9ed6e3d90df70484ff8d
Linux Linux 9363cd4977260bf7f211feee54f85858bba2320c
Linux Linux 5.10.266
Linux Linux 5.15.217
Linux Linux 7.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition in the Linux kernel's Thunderbolt subsystem. A NULL pointer dereference flaw occurs in tb_remove_work() when it tries to access tb->root_switch after another thread (tb_domain_remove()) has set it to NULL. This happens because tb_free_unplugged_xdomains() is called without proper synchronization or null checks.

Detection Guidance

This vulnerability is specific to the Linux kernel's Thunderbolt subsystem and involves a race condition leading to a NULL pointer dereference. Detection primarily involves checking kernel logs for Thunderbolt-related errors or crashes, particularly during device removal or domain operations. Monitor system logs for messages like 'NULL pointer dereference' or 'thunderbolt' errors. No specific commands are provided in the context for detection.

Impact Analysis

This could cause kernel crashes or system instability if exploited. Users might experience sudden system freezes or reboots when Thunderbolt devices are hot-plugged or unplugged. It primarily affects systems using Thunderbolt devices.

Mitigation Strategies

Apply the latest kernel updates from your Linux distribution to ensure the vulnerable code is patched. Avoid unplugging Thunderbolt devices during system operations to reduce race condition exposure. Monitor system stability and Thunderbolt device functionality after updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98688. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart