CVE-2026-97509

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97509", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.151Z", "datePublished": "2026-09-24T16:05:04.487Z", "dateUpdated": "2026-10-03T10:59:07.153Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:59:07.153Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Keep XDomain reference during the lifetime of a service\n\nThis is needed because we release the service ID in tb_service_release()\nand the ID array is owned by the parent XDomain."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - enumerate_services() runs from tb_xdomain_get_properties() after the peer's PROPERTIES_RESPONSE (tb_xdp_properties_request on the Thunderbolt/USB4 control channel) so tb_service children exist; the same peer's link-down hits tb_handle_hotplug() then tb_xdomain_unregister(). That is the TB fabric, not a routable IP protocol.\nAC:L - The peer controls both sides: property-block directories make enumerate_services() device_register() services without get_device(&xd->dev), then dropping the link runs tb_xdomain_unregister() \u2192 unregister_service() \u2192 device_del() put_device(parent) before tb_service_release() uses xd->service_ids. Advertise/unplug can be retried; no attacker-independent fault is required.\nPR:N - tb_domain_event_cb delivers TB_CFG_PKG_XDOMAIN_REQ/RESP to tb_xdomain_handle_request whenever tb_is_xdomain_enabled() (xdomain module_param defaults true, plus ACPI OSC). UUID/property handshake and enumerate_services() run with no device authorization or local credentials on the victim.\nUI:N - tb_xdomain_add() starts the handshake by itself; enumerate_services() and later tb_xdomain_unregister() (tb_domain_unregister_unplugged_xdomains after unplug) run from the connection-manager hotplug path with no victim mount, sysfs write, or authorization dialog.\nS:U - tb_service_release() ida_free()s the already-freed tb_xdomain.service_ids IDA in the host kernel; that does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After tb_xdomain_release() kfree()s the XDomain, tb_service_release() calls tb_service_parent() (reads svc->dev.parent->type) and ida_free(&xd->service_ids). That slab UAF of struct tb_xdomain can be reclaimed for an arbitrary kernel read.\nI:H - ida_free() writes the IDA/XArray embedded in the already-freed tb_xdomain; a sprayed replacement object is a kernel write and control-flow hijack primitive, as in other parent-IDA lifetime UAFs.\nA:H - tb_service_release() on a kfree'd tb_xdomain (parent type-check or ida_free of destroyed service_ids) oopses or panics the host; the peer can repeat advertise-and-unplug cycles to take Thunderbolt down."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/thunderbolt/xdomain.c"], "versions": [{"version": "d1ff70241a275133e1a0258b7c23588b122276c8", "lessThan": "a4567e5380e4e46d0ea9a28d2d675e5c6f013d54", "status": "affected", "versionType": "git"}, {"version": "d1ff70241a275133e1a0258b7c23588b122276c8", "lessThan": "daeaa6c7211d03ed061b0dd22a875fad9372b090", "status": "affected", "versionType": "git"}, {"version": "d1ff70241a275133e1a0258b7c23588b122276c8", "lessThan": "cca72fe513f3d6b1279fe83483f8a8990adbe0c6", "status": "affected", "versionType": "git"}, {"version": "d1ff70241a275133e1a0258b7c23588b122276c8", "lessThan": "57359bb31526c2f1bb0a7b9b69d8b8a6bd3f0e9f", "status": "affected", "versionType": "git"}, {"version": "d1ff70241a275133e1a0258b7c23588b122276c8", "lessThan": "8ab12d015884b8aa85ea7ed58c5a0bae4264fe60", "status": "affected", "versionType": "git"}, {"version": "d1ff70241a275133e1a0258b7c23588b122276c8", "lessThan": "ea60ae6233ca0fc0d414e9c11f0d86c63b303fc7", "status": "affected", "versionType": "git"}, {"version": "d1ff70241a275133e1a0258b7c23588b122276c8", "lessThan": "8b4060998637f06975fceee9b73845d8672d411e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/thunderbolt/xdomain.c"], "versions": [{"version": "4.15", "status": "affected"}, {"version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.266", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.10.266"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.15.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a4567e5380e4e46d0ea9a28d2d675e5c6f013d54"}, {"url": "https://git.kernel.org/stable/c/daeaa6c7211d03ed061b0dd22a875fad9372b090"}, {"url": "https://git.kernel.org/stable/c/cca72fe513f3d6b1279fe83483f8a8990adbe0c6"}, {"url": "https://git.kernel.org/stable/c/57359bb31526c2f1bb0a7b9b69d8b8a6bd3f0e9f"}, {"url": "https://git.kernel.org/stable/c/8ab12d015884b8aa85ea7ed58c5a0bae4264fe60"}, {"url": "https://git.kernel.org/stable/c/ea60ae6233ca0fc0d414e9c11f0d86c63b303fc7"}, {"url": "https://git.kernel.org/stable/c/8b4060998637f06975fceee9b73845d8672d411e"}], "title": "thunderbolt: Keep XDomain reference during the lifetime of a service", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/thunderbolt/xdomain.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a4567e5380e4e46d0ea9a28d2d675e5c6f013d54", "status": "affected", "version": "d1ff70241a275133e1a0258b7c23588b122276c8", "versionType": "git"}, {"lessThan": "daeaa6c7211d03ed061b0dd22a875fad9372b090", "status": "affected", "version": "d1ff70241a275133e1a0258b7c23588b122276c8", "versionType": "git"}, {"lessThan": "cca72fe513f3d6b1279fe83483f8a8990adbe0c6", "status": "affected", "version": "d1ff70241a275133e1a0258b7c23588b122276c8", "versionType": "git"}, {"lessThan": "57359bb31526c2f1bb0a7b9b69d8b8a6bd3f0e9f", "status": "affected", "version": "d1ff70241a275133e1a0258b7c23588b122276c8", "versionType": "git"}, {"lessThan": "8ab12d015884b8aa85ea7ed58c5a0bae4264fe60", "status": "affected", "version": "d1ff70241a275133e1a0258b7c23588b122276c8", "versionType": "git"}, {"lessThan": "ea60ae6233ca0fc0d414e9c11f0d86c63b303fc7", "status": "affected", "version": "d1ff70241a275133e1a0258b7c23588b122276c8", "versionType": "git"}, {"lessThan": "8b4060998637f06975fceee9b73845d8672d411e", "status": "affected", "version": "d1ff70241a275133e1a0258b7c23588b122276c8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/thunderbolt/xdomain.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.15"}, {"lessThan": "4.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.266", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.217", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Keep XDomain reference during the lifetime of a service\n\nThis is needed because we release the service ID in tb_service_release()\nand the ID array is owned by the parent XDomain."}], "id": "CVE-2026-97509", "lastModified": "2026-10-03T11:18:00.487", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-24T17:17:28.767", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/57359bb31526c2f1bb0a7b9b69d8b8a6bd3f0e9f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8ab12d015884b8aa85ea7ed58c5a0bae4264fe60"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8b4060998637f06975fceee9b73845d8672d411e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a4567e5380e4e46d0ea9a28d2d675e5c6f013d54"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cca72fe513f3d6b1279fe83483f8a8990adbe0c6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/daeaa6c7211d03ed061b0dd22a875fad9372b090"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ea60ae6233ca0fc0d414e9c11f0d86c63b303fc7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: thunderbolt: Keep XDomain reference during the lifetime of a service", "id": "2540537", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540537"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nthunderbolt: Keep XDomain reference during the lifetime of a service\nThis is needed because we release the service ID in tb_service_release()\nand the ID array is owned by the parent XDomain.", "A flaw was found in the Linux kernel's Thunderbolt subsystem. A local attacker could exploit this issue to cause a Denial of Service (DoS) or potentially execute arbitrary code. The vulnerability occurs because the driver fails to maintain a reference to the parent domain device during the lifetime of an active service, allowing the parent structure to be deallocated prematurely. When the service is later destroyed, accessing the released structure results in a use-after-free condition that crashes the system."], "name": "CVE-2026-97509", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97509\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97509\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97509.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a4567e5380e4e46d0ea9a28d2d675e5c6f013d54)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,daeaa6c7211d03ed061b0dd22a875fad9372b090)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8ab12d015884b8aa85ea7ed58c5a0bae4264fe60)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ea60ae6233ca0fc0d414e9c11f0d86c63b303fc7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8b4060998637f06975fceee9b73845d8672d411e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.10.266)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.15.217)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.266,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.217,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T00:30:18.224861+00:00", "updated": "2026-10-01T10:30:08.281200+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416", "CWE-825"]}