CVE-2026-98896

thunderbolt: Keep the domain reference while processing hotplug

Published Oct 23, 2026 CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Keep the domain reference while processing hotplug

We process hotplug events in a workqueue that may run after the domain
has been removed by tb_domain_remove(). For example if user unloads the
driver while at the same time plugging a device router we may have
scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by
taking the domain reference before scheduling the hotplug handler in
tb_queue_hotplug().

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d6cc51cd1a4aed1d9e2dd66d643d729acb4be560`	affected	< 06b2e894e640f6a3dbeb536a2d26d72426b26a46
`d6cc51cd1a4aed1d9e2dd66d643d729acb4be560`	affected	< 1d991f749a8255ee2ecc6307e2f27354ab631827
`d6cc51cd1a4aed1d9e2dd66d643d729acb4be560`	affected	< e8656465d08ed832e120c9cca4a6d0c8ccb45698
`d6cc51cd1a4aed1d9e2dd66d643d729acb4be560`	affected	< b61a4ae2ec6a0d363615d01106e0a2d284133a38
`d6cc51cd1a4aed1d9e2dd66d643d729acb4be560`	affected	< 04df2985159e381c88a923fae1bec2f8d0272412
`d6cc51cd1a4aed1d9e2dd66d643d729acb4be560`	affected	< 0a87af3b1e3aa2e09d160848daf0c39e765b73de
`d6cc51cd1a4aed1d9e2dd66d643d729acb4be560`	affected	< 138ec65b2c761f065b19d115aed2b8246fc272f5

Linux

affected

Version	Status	Constraints
`3.17`	affected	—
`0`	unaffected	< 3.17
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,06b2e894e640f6a3dbeb536a2d26d72426b26a46)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1d991f749a8255ee2ecc6307e2f27354ab631827)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e8656465d08ed832e120c9cca4a6d0c8ccb45698)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b61a4ae2ec6a0d363615d01106e0a2d284133a38)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,04df2985159e381c88a923fae1bec2f8d0272412)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0a87af3b1e3aa2e09d160848daf0c39e765b73de)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,138ec65b2c761f065b19d115aed2b8246fc272f5)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,06b2e894e640f6a3dbeb536a2d26d72426b26a46)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1d991f749a8255ee2ecc6307e2f27354ab631827)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e8656465d08ed832e120c9cca4a6d0c8ccb45698)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b61a4ae2ec6a0d363615d01106e0a2d284133a38)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,04df2985159e381c88a923fae1bec2f8d0272412)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0a87af3b1e3aa2e09d160848daf0c39e765b73de)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,138ec65b2c761f065b19d115aed2b8246fc272f5)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.187% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98896.mbox
https://git.kernel.org/stable/c/04df2985159e381c88a923fae1bec2f8d0272412
https://git.kernel.org/stable/c/06b2e894e640f6a3dbeb536a2d26d72426b26a46
https://git.kernel.org/stable/c/0a87af3b1e3aa2e09d160848daf0c39e765b73de
https://git.kernel.org/stable/c/138ec65b2c761f065b19d115aed2b8246fc272f5
https://git.kernel.org/stable/c/1d991f749a8255ee2ecc6307e2f27354ab631827
https://git.kernel.org/stable/c/b61a4ae2ec6a0d363615d01106e0a2d284133a38
https://git.kernel.org/stable/c/e8656465d08ed832e120c9cca4a6d0c8ccb45698
https://nvd.nist.gov/vuln/detail/CVE-2026-98896
https://www.cve.org/CVERecord?id=CVE-2026-98896

History

Oct 27, 2026 9:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Oct 27, 2026 4:30 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98896.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98896 https://www.cve.org/CVERecord?id=CVE-2026-98896
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Oct 23, 2026 6:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Oct 23, 2026 3:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Oct 23, 2026 12:00 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tb_domain_remove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by taking the domain reference before scheduling the hotplug handler in tb_queue_hotplug().
Title		thunderbolt: Keep the domain reference while processing hotplug
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/04df2985159e381c88a923fae1bec2f8d0272412 https://git.kernel.org/stable/c/06b2e894e640f6a3dbeb536a2d26d72426b26a46 https://git.kernel.org/stable/c/0a87af3b1e3aa2e09d160848daf0c39e765b73de https://git.kernel.org/stable/c/138ec65b2c761f065b19d115aed2b8246fc272f5 https://git.kernel.org/stable/c/1d991f749a8255ee2ecc6307e2f27354ab631827 https://git.kernel.org/stable/c/b61a4ae2ec6a0d363615d01106e0a2d284133a38 https://git.kernel.org/stable/c/e8656465d08ed832e120c9cca4a6d0c8ccb45698