CVE-2026-98693 thunderbolt: Hold a router reference for each allocated HopID
MediumCVSS 5.2
EPSS 0.20%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Hold a router reference for each allocated HopID
tb_stop() drops the reference to all DP tunnels but does not deactivate
them, thus nothing cancels a dprx_work still in flight (which holds its
own tunnel reference) and the tunnel can outlive tb_switch_remove(). The
HopID releases in tb_path_free() then operate on freed IDAs and trigger
warnings like
ida_free called for id=8 which is not allocated.
This can be triggered by unbinding the driver while a DP tunnel is still
waiting for the DPRX capabilities read to finish. On the Apple NHI
unplugging the cable runs into just that reliably because the read can
never finish right now and because the unplug powers down the entire
USB4 complex and removes the NHI device.
Take a router reference whenever an input or output HopID is allocated
and drop it again after the HopID is released. This keeps the ports and
their HopID IDAs alive for as long as they are used.
The KUnit tests allocate routers without ever registering their devices
so initialize the embedded struct device there as well and drop its
initial reference when the test is finished.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/kernel(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/kernel(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/openshift/ose-rhel-coreos-9(Red Hat:openshift:4) | All versions | No fix listed |
| redhat/openshift/ose-rhel-coreos-9(Red Hat:openshift:5) | All versions | No fix listed |
| Linux kernel | >= d6d458d42e1e1544a18f37f1d5c840e00d5261b9, < c444d2c17dc236680324fd989232199680a6c419 | c444d2c17dc236680324fd989232199680a6c419 |
| Linux kernel | >= d6d458d42e1e1544a18f37f1d5c840e00d5261b9, < 2b5f976119d8f099a03cbf700df3d9c8690fe33d | 2b5f976119d8f099a03cbf700df3d9c8690fe33d |
| Linux kernel | >= d6d458d42e1e1544a18f37f1d5c840e00d5261b9, < 032c59c7681c661b63123231824170c025afb7e7 | 032c59c7681c661b63123231824170c025afb7e7 |
| Linux kernel | = 6.14 | No fix listed |
| Linux kernel | < 6.18.56 | 6.18.56 |
| Linux kernel | < 7.2.10 | 7.2.10 |
| Linux kernel | < 7.3 | 7.3 |
| debian/linux(Debian:14) | < 7.2.10-1 | 7.2.10-1 |
| debian/linux(Debian:14) | = 6.12.100-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.101-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.105-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.107-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.111-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.113-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.38-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.41-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.43-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.43-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.48-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.57-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.57-1~bpo12+1 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:14) | = 6.12.63-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.63-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.69-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.69-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.73-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.73-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.74-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.74-2 | No fix listed |
| debian/linux(Debian:14) | = 6.12.74-2~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.85-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.85-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.86-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.86-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.88-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.88-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-2 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-2~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.94-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.94-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.95-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.95-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.96-1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.10-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.11-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.8-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.9-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13~rc6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.14.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.14.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.14.6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.16-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.11-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.12-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.12-2 | No fix listed |
| debian/linux(Debian:14) | = 6.16.3-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.3-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.5-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.6-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.7-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.8-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.9-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.11-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.13-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.13-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.6-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.7-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.7-2 | No fix listed |
| debian/linux(Debian:14) | = 6.17.8-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.8-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.9-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.12-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.13-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.14-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.15-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.15-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.3-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.5-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.5-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.8-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.9-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.9-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.18~rc4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.18~rc4-1~exp2 | No fix listed |
| debian/linux(Debian:14) | = 6.18~rc5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.18~rc6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.18~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.10-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.11-1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.11-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.13-1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.13-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.14-1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.14-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.6-1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.6-2 | No fix listed |
| debian/linux(Debian:14) | = 6.19.6-2~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.8-1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.8-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.19~rc4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19~rc5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19~rc6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19~rc8-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.0-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.10-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.10-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.12-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.12-2 | No fix listed |
| debian/linux(Debian:14) | = 7.0.12-2~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.13-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.13-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.14-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.3-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.4-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.4-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.7-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.7-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.9-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.9-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.10-1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.12-1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.13-1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.13-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.3-1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.3-1+sunvdc | No fix listed |
| debian/linux(Debian:14) | = 7.1.3-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.4-1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.5-1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.6-1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.7-1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.7-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.8-1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.8-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.8-2 | No fix listed |
| debian/linux(Debian:14) | = 7.1.9-1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.9-1+sparc64 | No fix listed |
| debian/linux(Debian:14) | = 7.1~rc2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.1~rc3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.1~rc4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.1~rc4-1~exp2 | No fix listed |
| debian/linux(Debian:14) | = 7.1~rc5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.1~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.2.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.2.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.2.6-1 | No fix listed |
| debian/linux(Debian:14) | = 7.2.6-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.2.7-1 | No fix listed |
| debian/linux(Debian:14) | = 7.2.8-1 | No fix listed |
| debian/linux(Debian:14) | = 7.2.9-1 | No fix listed |
| debian/linux(Debian:14) | = 7.2.9-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.2~rc3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.2~rc5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.2~rc7-1~exp1 | No fix listed |
| ubuntu/linux(Ubuntu:26.04) | < 7.0.0-43.43 | 7.0.0-43.43 |
| ubuntu/linux-raspi(Ubuntu:26.04) | < 7.0.0-1023.23 | 7.0.0-1023.23 |
| azure linux kernel(Azure Linux:4.0) | < 0:6.18.57-1.1.azl4 | 0:6.18.57-1.1.azl4 |
References
- MSRC Security Update Guide vendor-advisory
- Red Hat CVE page vendor-advisory
- Red Hat Bugzilla 2555174 issue-tracking
- www.cve.org
- nvd.nist.gov
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- Debian Security Tracker CVE-2026-98693 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-9018-2: Linux kernel (HWE) vulnerabilities vendor-advisory
- Release Notes vendor-advisory
- USN-9018-1 vendor-advisory
- USN-9020-1 vendor-advisory
- USN-9019-1 vendor-advisory
- USN-9021-1 vendor-advisory