CVE-2026-98690
Received Received - Intake

Domain Reference Leak in Linux Kernel Thunderbolt

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is canceled tb_tunnel_one_dp() takes a domain reference which is only dropped once tb_dp_tunnel_active() has run on the work queue. If that work is cancelled that reference is leaked. Since commit f5cc545f5969 ("thunderbolt: Wait for tb_domain_release() to complete when driver is removed") instead of just leaking memory this now also blocks in the completion wait forever when unbinding the driver. This can be triggered whenever a DP tunnel is torn down before the DPRX read has completed, e.g. by unplugging within the timeout, and then unbinding the driver. That reference only exists to keep the domain around while the DPRX work is scheduled so let the work itself own it: take it in tb_dp_dprx_start() and drop it in both places that end the work. Get/put are then paired inside the same file and it doesn't matter anymore if the callback ever runs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98690
EUVD
EUVD-2026-103944

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux d6d458d42e1e1544a18f37f1d5c840e00d5261b9
Linux Linux d6d458d42e1e1544a18f37f1d5c840e00d5261b9
Linux Linux d6d458d42e1e1544a18f37f1d5c840e00d5261b9
Linux Linux 6.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a domain reference leak in the Thunderbolt subsystem. When a DisplayPort (DP) tunnel is torn down before a DPRX read completes, the domain reference is not properly released. This can cause the system to block indefinitely when unbinding the driver, leading to potential hangs or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's Thunderbolt subsystem and may not have direct network detection methods. Monitor kernel logs for Thunderbolt-related errors or warnings, particularly during device unplugging or driver unbinding. Check for stalled work queues or domain reference leaks in dmesg output after Thunderbolt device operations.

Impact Analysis

If exploited, this flaw could cause system instability when unplugging Thunderbolt devices or unbinding the driver. It may lead to hangs, crashes, or resource exhaustion, disrupting normal system operation.

Mitigation Strategies

Apply the latest Linux kernel updates to ensure the fix is included. Avoid unplugging Thunderbolt devices during active DP tunnel operations. If unbinding the Thunderbolt driver, ensure no devices are in use to prevent potential hangs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98690. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart