VulnerabilityPublished 18 Oct 2026

CVE-2026-98689: Linux kernel · thunderbolt: Don't access a DP tunnel after its DPRX read was canceled

Source GCVE Database

Authoritative record:CVE-2026-98689· Medium

Not known to be exploited · fixed in 419fa32fa5bc2d7fb9d0d15d5630b1c1090808b3 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 419fa32fa5bc2d7fb9d0d15d5630b1c1090808b3, 405a969c0b3356639116db89ab367be1d64b77c0, 2c2fd6a7fd5e1218db7e17336fc1a0393b6949e6

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-8x4h-8gwm-w6jp

What to do

Upgrade Linux kernel to 419fa32fa5bc2d7fb9d0d15d5630b1c1090808b3, 405a969c0b3356639116db89ab367be1d64b77c0 or 2c2fd6a7fd5e1218db7e17336fc1a0393b6949e6.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ d6d458d42e1e1544a18f37f1d5c840e00d5261b9, < 419fa32fa5bc2d7fb9d0d15d5630b1c1090808b3	Fixed in 419fa32fa5bc2d7fb9d0d15d5630b1c1090808b3
LinuxLinux	Affected ≥ d6d458d42e1e1544a18f37f1d5c840e00d5261b9, < 405a969c0b3356639116db89ab367be1d64b77c0	Fixed in 405a969c0b3356639116db89ab367be1d64b77c0
LinuxLinux	Affected ≥ d6d458d42e1e1544a18f37f1d5c840e00d5261b9, < 2c2fd6a7fd5e1218db7e17336fc1a0393b6949e6	Fixed in 2c2fd6a7fd5e1218db7e17336fc1a0393b6949e6
LinuxLinux	Affected =6.14	Fixed in–

AI-suggested

A fix for this vulnerability has been implemented in the Linux kernel by correcting the locking and flag checking logic in the Thunderbolt driver. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, updating to the patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the input data; users should consult the vendor or Linux kernel advisory for the exact fixed versions and update instructions.

Description

A vulnerability in the Linux kernel's Thunderbolt driver was resolved that involved accessing a DisplayPort (DP) tunnel after its DPRX read operation was canceled. The issue occurred because the code checked a cancellation flag without proper locking, allowing a callback to run on a tunnel that had already been torn down during system suspend or shutdown. This could lead to improper handling of the DP tunnel state.

Impact

The vulnerability could cause the Linux kernel Thunderbolt driver to access and operate on a DisplayPort tunnel that has already been torn down, potentially leading to use-after-free or race conditions during system suspend or shutdown. This could result in kernel instability or crashes. There is no indication of remote code execution or privilege escalation from the provided data.

Summary

The vulnerability in the Linux kernel Thunderbolt driver (CVE-2026-98689) involved the function tb_dp_dprx_work() checking the dprx_canceled flag before acquiring the tb->lock, missing a concurrent tb_dp_dprx_stop() call that could not cancel already running work. This caused the driver to poll DPRX capabilities and invoke a callback on a DP tunnel that was already torn down while the domain was suspending or going away. The issue was triggered by canceling the DPRX read from outside the ordered workqueue, such as during suspend operations. The fix involved checking the cancellation flag with the lock held and clearing the flag appropriately to ensure callbacks do not run on inactive tunnels.

References

Community reviews

Loading reviews…