CVE-2026-98693 thunderbolt: Hold a router reference for each allocated HopID

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tbstop drops the reference to all DP tunnels but does not deactivate them, thus nothing cancels a dprxwork still in flight which holds its own tunnel reference and the...

CVE-2026-98693

The Linux kernel contains a vulnerability in the thunderbolt driver where tb_stop() drops references to DP tunnels without deactivating them. This allows tunnels to outlive tb_switch_remove(), causing dprx_work to hold references to freed IDAs, resulting in kernel warnings (e.g., ida_free called ...

CVE-2026-98692

The Linux kernel contains a memory leak vulnerability in the thunderbolt subsystem. Specifically, the tb_tunnel_alloc_dp() function accepts an optional callback; if this callback is missing, tb_dp_dprx_start() reads capabilities synchronously and fails to queue work. This causes the tunnel refere...

CVE-2026-98692 thunderbolt: Make the DP tunnel activation callback mandatory

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Make the DP tunnel activation callback mandatory tbtunnelallocdp takes an optional callback which is run from dprxwork once the DPRX capabilities read has completed. Without that callback tbdpdprxstart reads the...

EUVD-2026-103946

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Make the DP tunnel activation callback mandatory tbtunnelallocdp takes an optional callback which is run from dprxwork once the DPRX capabilities read has completed. Without that callback tbdpdprxstart reads the...

CVE-2026-98692 thunderbolt: Make the DP tunnel activation callback mandatory

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Make the DP tunnel activation callback mandatory tbtunnelallocdp takes an optional callback which is run from dprxwork once the DPRX capabilities read has completed. Without that callback tbdpdprxstart reads the...

CVE-2026-98691 thunderbolt: Tear down inactive DP tunnels when the domain is stopped

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tbstop only tears down DMA tunnels so a DP tunnel that is still waiting for dprxwork to complete keeps that work queued while the routers are removed and the...

CVE-2026-98691

The Linux kernel contains a vulnerability where the thunderbolt subsystem fails to tear down inactive DP tunnels when a domain is stopped. Specifically, tb_stop() only handles DMA tunnels, allowing DP tunnels awaiting dprx_work to remain queued. This results in callbacks running against already t...

CVE-2026-98691 thunderbolt: Tear down inactive DP tunnels when the domain is stopped

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tbstop only tears down DMA tunnels so a DP tunnel that is still waiting for dprxwork to complete keeps that work queued while the routers are removed and the...

EUVD-2026-103945

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tbstop only tears down DMA tunnels so a DP tunnel that is still waiting for dprxwork to complete keeps that work queued while the routers are removed and the...

CVE-2026-98690 thunderbolt: Fix domain reference leak when DPRX read is canceled

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is canceled tbtunnelonedp takes a domain reference which is only dropped once tbdptunnelactive has run on the work queue. If that work is cancelled that reference is leaked...

CVE-2026-98690

The Linux kernel contains a vulnerability in the thunderbolt driver where a domain reference is leaked when a DPRX read is canceled. Specifically, the tb_tunnel_one_dp() function takes a reference that is only dropped once; if tb_dp_tunnel_active() work is canceled, the reference remains leaked. ...

CVE-2026-98690 thunderbolt: Fix domain reference leak when DPRX read is canceled

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is canceled tbtunnelonedp takes a domain reference which is only dropped once tbdptunnelactive has run on the work queue. If that work is cancelled that reference is leaked...

EUVD-2026-103944

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is canceled tbtunnelonedp takes a domain reference which is only dropped once tbdptunnelactive has run on the work queue. If that work is cancelled that reference is leaked...

CVE-2026-98689 thunderbolt: Don't access a DP tunnel after its DPRX read was canceled

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tbdpdprxwork checks -dprxcanceled before it takes tb-lock so it misses a tbdpdprxstop that could not cancel the already running work. It then polls the DPRX...

CVE-2026-98689

The Linux kernel contains a vulnerability in the thunderbolt component where tb_dp_dprx_work() checks the ->dprx_canceled flag before acquiring the tb->lock. This race condition allows the system to miss a tb_dp_dprx_stop() call, resulting in the kernel polling and running a callback for a ...

EUVD-2026-103943

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tbdpdprxwork checks -dprxcanceled before it takes tb-lock so it misses a tbdpdprxstop that could not cancel the already running work. It then polls the DPRX...

CVE-2026-98689 thunderbolt: Don't access a DP tunnel after its DPRX read was canceled

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tbdpdprxwork checks -dprxcanceled before it takes tb-lock so it misses a tbdpdprxstop that could not cancel the already running work. It then polls the DPRX...

CVE-2026-98688 thunderbolt: Fix NULL dereference in tb_remove_work()

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tbremovework There is a slight race between tbremovework and tbdomainremove which leads to dereferencing a NULL tb-rootswitch pointer inside tbfreeunpluggedxdomains: Thread A Thread B...

CVE-2026-98688

The Linux kernel contains a NULL pointer dereference vulnerability in the thunderbolt subsystem. A race condition exists between tb_remove_work() and tb_domain_remove() which can cause the tb->root_switch pointer to be dereferenced while it is NULL inside the tb_free_unplugged_xdomains() funct...