CVE-2026-98690

A flaw was found in the Linux kernel's Thunderbolt subsystem. This flaw allows a local user to cause a Denial of Service DoS by causing kernel cleanup operations to hang indefinitely. When a DisplayPort DP tunnel is disconnected before an internal read operation completes, the driver leaks an...

CVE-2026-98689

A flaw was found in the Linux kernel's Thunderbolt subsystem. A race condition occurs when DisplayPort DP read operations are canceled during system suspend or device disconnection, allowing work handlers to access tunnel structures that have already been torn down. A local attacker could trigger...

CVE-2026-98688

A flaw was found in the Linux kernel's Thunderbolt subsystem. A race condition during device removal operations can lead to a NULL pointer dereference. A local user could exploit this timing issue during device disconnection to trigger a kernel crash, resulting in a Denial of Service DoS...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.14 contains security vulnerabilities. These vulnerabilities stem from the thunderbolt subsystem, where the tbstop function does not disable the DP tunnel, and the HopID is not maintained during allocation, resulting in the IDA being released by the tbpathfree operation...

CVE-2026-97510

A flaw was found in the Linux kernel's Thunderbolt subsystem. When handling communication responses, a failure to set up a configuration request—such as when the control channel is already shut down—causes the system to return an error without releasing allocated memory. A local user or repeated...

CVE-2026-97509

A flaw was found in the Linux kernel's Thunderbolt subsystem. A local attacker could exploit this issue to cause a Denial of Service DoS or potentially execute arbitrary code. The vulnerability occurs because the driver fails to maintain a reference to the parent domain device during the lifetime...

CVE-2026-97508

A flaw was found in the Linux kernel's Thunderbolt subsystem. When a Thunderbolt domain is stopped, the driver fails to properly clear the root switch reference while handling active cross-domain requests. A connected host sending communication requests during domain shutdown can trigger an inval...

CVE-2026-80736 thunderbolt: Fix bandwidth group reservation indexing

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth group reservation indexing Valid bandwidth group IDs range from 1 through MAXGROUPS, while Group ID 0 is reserved. tbconsumeddpbandwidth uses the Group ID directly to index its local groupreserved array...

CVE-2026-74575

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...

EUVD-2026-59640

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...

CVE-2026-74575

CVE-2026-74575 : The Linux kernel Thunderbolt XDomain use-after-free on disconnect has been addressed. The fix adds a new xd->removing flag protected by xd->lock and uses it in tb_xdomain_remove() to coordinate with queue_delayed_work() sites. This ensures proper serialization between the r...