CVE-2026-89737

What it actually does

Use-after-free in the Thunderbolt altmode driver where tbt_altmode_remove drops plug and cable references before the queued work item completes or drains, allowing the work function and VDM callbacks to dereference freed objects and potentially requeue.

Why it matters to the business

Kernel instability or memory corruption on Linux systems using USB-C Thunderbolt hardware can cause crashes, degraded device functionality, or local privilege escalation, with urgency for servers and workstations handling external peripherals.

How an attack unfolds

An attacker with local access triggers repeated Thunderbolt device attach/remove or VDM events to race the workqueue against tbt_altmode_remove, causing the scheduled work to access already-freed references and potentially corrupt kernel memory for code execution.

How to fix it

Update the Linux kernel to a version containing the fix that disables and drains tbt->work before dropping references in tbt_altmode_remove; rebuild and reboot systems after applying the patch.

How to confirm the fix worked

Confirm the updated kernel source contains the disable/drain sequence before reference drop in tbt_altmode_remove; test by exercising Thunderbolt attach/remove cycles and verify absence of workqueue-related use-after-free warnings in dmesg.

Typical attack path

1. Obtain local access on a Linux system with Thunderbolt/USB-C support
2. Trigger device plug/unplug or VDM messages to schedule tbt work
3. Force concurrent tbt_altmode_remove path to drop references without draining work
4. Work function dereferences freed objects leading to UAF
5. Leverage corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for use-after-free warnings, workqueue errors, or thunderbolt/typec stack traces during device removal; correlate with audit logs showing repeated Thunderbolt attach events from untrusted users.

What your security team should do

• Prioritize kernel updates on all Linux endpoints with Thunderbolt hardware
• Monitor for kernel oops or slab corruption logs involving thunderbolt or typec
• Restrict local Thunderbolt access via policy until patched
• Include the fix in standard image builds and CI test suites for USB-C paths