Cloudanix VulnDB

CVE-2026-98688

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in the Linux kernel's handling of Thunderbolt device removal can cause the system to crash when certain hardware events happen at exactly the wrong moment.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition between tb_remove_work() and tb_domain_remove() allows tb_free_unplugged_xdomains() to dereference a NULL tb->root_switch pointer after tb_domain_remove() clears it without canceling the delayed work item.

Why it matters to the business

Systems using Thunderbolt hardware may experience kernel crashes or unexpected reboots when devices are hot-removed under specific timing, creating brief availability impact; overall exposure remains low given the five-day publication age and negligible exploitation probability.

How an attack unfolds

An attacker with local access or the ability to trigger Thunderbolt device insertion and removal events races the kernel's delayed work callback against domain teardown, causing the NULL dereference during unplugged XDomain cleanup.

How to fix it

Update to a Linux kernel containing commit a8937f35cf39 or later equivalent that restores the root_switch check and lock ordering around tb_free_unplugged_xdomains(); apply the fix via distribution kernel packages as soon as available.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or later; inspect thunderbolt driver source for presence of the root_switch NULL check inside the locked section of tb_remove_work().

Typical attack path

  1. Gain local execution context or physical access to Thunderbolt ports
  2. Trigger rapid device connect/disconnect sequences while domain removal is in progress
  3. Force tb_remove_work() to execute after root_switch has been nulled
  4. Trigger NULL dereference in tb_free_unplugged_xdomains()

How to detect it

Search kernel logs for oops or panic messages referencing tb_free_unplugged_xdomains or tb_remove_work around Thunderbolt device removal events; correlate with dmesg entries showing root_switch access after domain teardown.

What your security team should do

  • Monitor kernel update channels for the Thunderbolt race fix and schedule deployment within normal patch windows
  • Review Thunderbolt hot-plug handling in high-availability systems for additional hardening
  • Track EPSS and KEV status weekly given the recent publication date

The record

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tb_remove_work() There is a slight race between tb_remove_work() and tb_domain_remove() which leads to dereferencing a NULL tb->root_switch pointer inside tb_free_unplugged_xdomains(): Thread A Thread B tb_remove_work() tb_domain_remove() mutex_lock(&tb->lock) tb_stop() /* doesn't cancel a running callback */ cancel_delayed_work(&tcm->remove_work) ... tb_switch_remove(tb->root_switch) tb->root_switch = NULL mutex_unlock(&tb->lock) mutex_lock(&tb->lock) ... /* without checking ->root_switch */ tb_free_unplugged_xdomains(tb->root_switch) mutex_unlock(&tb->lock) Commit a8937f35cf39 ("thunderbolt: Remove XDomain from the bus without holding tb->lock") doesn't seem right to move tb_free_unplugged_xdomains() out of the &tb->lock section and the check for tb->root_switch, in particular. It states: For this reason separate removing the XDomain from the topology data structures (where we need the lock) from unregistering the device from the bus (where remove callbacks of the drivers are being called). tb_free_unplugged_xdomains() belongs to the former group of functions requiring the lock. And it also calls tb_xdomain_remove() which should only be called with &tb->lock held. Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.

Affected packages

Ecosystem Package Introduced Fixed