CVE-2026-98692

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98692", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.364Z", "datePublished": "2026-10-18T15:46:16.794Z", "dateUpdated": "2026-11-06T17:15:04.213Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-06T17:15:04.213Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Make the DP tunnel activation callback mandatory\n\ntb_tunnel_alloc_dp() takes an optional callback which is run from\ndprx_work once the DPRX capabilities read has completed. Without that\ncallback tb_dp_dprx_start() reads the capabilities synchronously and\nnever queues the work. It however always takes a tunnel reference which\nis only dropped by dprx_work itself or by tb_dp_dprx_stop() when\ncancel_delayed_work() actually canceled that work. That reference is\nthus leaked for every tunnel without a callback.\n\nThe only tunnels without one are those from tb_tunnel_discover_dp(),\nwhich are activated again when restoring from hibernation.\nPass the callback to tb_tunnel_discover_dp() as well and drop the\nsynchronous path such that the DPRX capabilities are always read from\ndprx_work. Hibernation restore then also no longer blocks for up to 12\nseconds while waiting for that read to complete.\n\nAlso fix up the KUnit tests."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/thunderbolt/tb.c", "drivers/thunderbolt/test.c", "drivers/thunderbolt/tunnel.c", "drivers/thunderbolt/tunnel.h"], "versions": [{"version": "d6d458d42e1e1544a18f37f1d5c840e00d5261b9", "lessThan": "39a2c4e5e606cf49b83595971b449b3fb80743c6", "status": "affected", "versionType": "git"}, {"version": "d6d458d42e1e1544a18f37f1d5c840e00d5261b9", "lessThan": "47d60ea801fc333a10c576691eca2e7840b02d3d", "status": "affected", "versionType": "git"}, {"version": "d6d458d42e1e1544a18f37f1d5c840e00d5261b9", "lessThan": "12f5d8b85a66a0ac08d082517d92ce136f8c0d42", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/thunderbolt/tb.c", "drivers/thunderbolt/test.c", "drivers/thunderbolt/tunnel.c", "drivers/thunderbolt/tunnel.h"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.61", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.61"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/39a2c4e5e606cf49b83595971b449b3fb80743c6"}, {"url": "https://git.kernel.org/stable/c/47d60ea801fc333a10c576691eca2e7840b02d3d"}, {"url": "https://git.kernel.org/stable/c/12f5d8b85a66a0ac08d082517d92ce136f8c0d42"}], "title": "thunderbolt: Make the DP tunnel activation callback mandatory", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/thunderbolt/tb.c", "drivers/thunderbolt/test.c", "drivers/thunderbolt/tunnel.c", "drivers/thunderbolt/tunnel.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "39a2c4e5e606cf49b83595971b449b3fb80743c6", "status": "affected", "version": "d6d458d42e1e1544a18f37f1d5c840e00d5261b9", "versionType": "git"}, {"lessThan": "47d60ea801fc333a10c576691eca2e7840b02d3d", "status": "affected", "version": "d6d458d42e1e1544a18f37f1d5c840e00d5261b9", "versionType": "git"}, {"lessThan": "12f5d8b85a66a0ac08d082517d92ce136f8c0d42", "status": "affected", "version": "d6d458d42e1e1544a18f37f1d5c840e00d5261b9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/thunderbolt/tb.c", "drivers/thunderbolt/test.c", "drivers/thunderbolt/tunnel.c", "drivers/thunderbolt/tunnel.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.61", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Make the DP tunnel activation callback mandatory\n\ntb_tunnel_alloc_dp() takes an optional callback which is run from\ndprx_work once the DPRX capabilities read has completed. Without that\ncallback tb_dp_dprx_start() reads the capabilities synchronously and\nnever queues the work. It however always takes a tunnel reference which\nis only dropped by dprx_work itself or by tb_dp_dprx_stop() when\ncancel_delayed_work() actually canceled that work. That reference is\nthus leaked for every tunnel without a callback.\n\nThe only tunnels without one are those from tb_tunnel_discover_dp(),\nwhich are activated again when restoring from hibernation.\nPass the callback to tb_tunnel_discover_dp() as well and drop the\nsynchronous path such that the DPRX capabilities are always read from\ndprx_work. Hibernation restore then also no longer blocks for up to 12\nseconds while waiting for that read to complete.\n\nAlso fix up the KUnit tests."}], "id": "CVE-2026-98692", "lastModified": "2026-11-06T18:18:29.917", "metrics": {}, "published": "2026-10-18T16:17:22.623", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/12f5d8b85a66a0ac08d082517d92ce136f8c0d42"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/39a2c4e5e606cf49b83595971b449b3fb80743c6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47d60ea801fc333a10c576691eca2e7840b02d3d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: thunderbolt: Make the DP tunnel activation callback mandatory", "id": "2555137", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555137"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nthunderbolt: Make the DP tunnel activation callback mandatory\ntb_tunnel_alloc_dp() takes an optional callback which is run from\ndprx_work once the DPRX capabilities read has completed. Without that\ncallback tb_dp_dprx_start() reads the capabilities synchronously and\nnever queues the work. It however always takes a tunnel reference which\nis only dropped by dprx_work itself or by tb_dp_dprx_stop() when\ncancel_delayed_work() actually canceled that work. That reference is\nthus leaked for every tunnel without a callback.\nThe only tunnels without one are those from tb_tunnel_discover_dp(),\nwhich are activated again when restoring from hibernation.\nPass the callback to tb_tunnel_discover_dp() as well and drop the\nsynchronous path such that the DPRX capabilities are always read from\ndprx_work. Hibernation restore then also no longer blocks for up to 12\nseconds while waiting for that read to complete.\nAlso fix up the KUnit tests.", "A flaw was found in the Linux kernel's Thunderbolt subsystem. DisplayPort (DP) tunnels activated without a required completion callback fail to release object references during tunnel setup, such as when restoring from system hibernation. A local user or repeated hibernation cycles can cause kernel references to remain permanently allocated, leading to a memory leak and a potential Denial of Service (DoS)."], "name": "CVE-2026-98692", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98692\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98692\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98692.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d6d458d42e1e1544a18f37f1d5c840e00d5261b9,47d60ea801fc333a10c576691eca2e7840b02d3d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d6d458d42e1e1544a18f37f1d5c840e00d5261b9,12f5d8b85a66a0ac08d082517d92ce136f8c0d42)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T20:00:12.043851+00:00", "updated": "2026-10-23T05:15:14.414082+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}