The Linux kernel thunderbolt network driver (tbnet) had a teardown sequence flaw where DMA paths were disabled after stopping the rings and freeing buffers. This order mismatch with the setup sequence caused the 'pending' bit in __tb_path_deactivate_hop() to never clear on certain hardware (e.g., ASMedia ASM4242 host router), resulting in repeated teardown timeouts (-ETIMEDOUT) and eventual loss of the XDomain control channel. The failure is silent above the thunderbolt core, and repeated failures require a power cycle to restore functionality. Changing the teardown sequence to deactivate DMA paths before stopping rings resolves the issue, eliminating timeouts and preventing link failures without affecting throughput or latency.

On affected hardware, repeated network interface teardowns can fail silently due to the 'pending' bit never clearing, causing timeouts and eventual loss of the XDomain control channel. This leads to the peer node becoming unreachable and requires a power cycle to recover the controller. Hosts with routers that properly drain the hop do not experience functional differences. There is no indication of remote code execution or data leakage, but network connectivity can be disrupted until manual intervention.

A fix is available that changes the teardown sequence to deactivate DMA paths before stopping the rings, resolving the timeout and link failure issue. Users should update to a Linux kernel version that includes this fix. Since the vulnerability is in the Linux kernel driver, applying the official kernel update or patch that addresses CVE-2026-74691 is the recommended remediation. No other mitigations are indicated.