CVE-2026-98691
Received Received - Intake

Thunderbolt DP Tunnel Handling Flaw in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tb_stop() only tears down DMA tunnels so a DP tunnel that is still waiting for dprx_work to complete keeps that work queued while the routers are removed and the control channel is stopped. The work only stops once the DPRX timeout has passed and because it requeues itself until then the flush_workqueue() in tb_domain_remove() won't wait for its final run. The callback then runs against a domain that is already torn down. A reference to that domain is kept so the completion waiting for that domain to disappear in unbind will block until the timeout is eventually reached. Tear down DP tunnels that are not active yet as well which also cancels that work. Tunnels for displays that are already alive are untouched and keep working.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98691
EUVD
EUVD-2026-103945

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux d6d458d42e1e1544a18f37f1d5c840e00d5261b9
Linux Linux d6d458d42e1e1544a18f37f1d5c840e00d5261b9
Linux Linux d6d458d42e1e1544a18f37f1d5c840e00d5261b9
Linux Linux 6.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of DisplayPort (DP) tunnels when a Thunderbolt domain is stopped. The function tb_stop() only tears down DMA tunnels but not inactive DP tunnels, causing their work queues to remain active. This leads to delayed cleanup and potential issues when the domain is already torn down, blocking completions waiting for the domain to disappear.

Detection Guidance

This vulnerability is specific to the Linux kernel's Thunderbolt subsystem and does not have direct network detection methods. Detection involves checking the kernel version and Thunderbolt driver status. Use commands like 'uname -r' to check the kernel version and 'lsmod | grep thunderbolt' to verify if the Thunderbolt module is loaded.

Impact Analysis

This vulnerability could cause system hangs or delays during Thunderbolt device disconnection, as cleanup processes may block until timeouts expire. It may also lead to instability in systems using Thunderbolt devices with DisplayPort functionality, potentially requiring a reboot to recover.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this Thunderbolt vulnerability. Monitor kernel security advisories and apply updates promptly. If Thunderbolt is not required, consider disabling the Thunderbolt module using 'modprobe -r thunderbolt'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98691. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart