In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled… (CVE-2026-98689)

The vulnerability in the Linux kernel Thunderbolt driver (CVE-2026-98689) involved the function tb_dp_dprx_work() checking the dprx_canceled flag before acquiring the tb->lock, missing a concurrent tb_dp_dprx_stop() call that could not cancel already running work. This caused the driver to poll DPRX capabilities and invoke a callback on a DP tunnel that was already torn down while the domain was suspending or going away. The issue was triggered by canceling the DPRX read from outside the ordered workqueue, such as during suspend operations. The fix involved checking the cancellation flag with the lock held and clearing the flag appropriately to ensure callbacks do not run on inactive tunnels.

The vulnerability could cause the Linux kernel Thunderbolt driver to access and operate on a DisplayPort tunnel that has already been torn down, potentially leading to use-after-free or race conditions during system suspend or shutdown. This could result in kernel instability or crashes. There is no indication of remote code execution or privilege escalation from the provided data.

A fix for this vulnerability has been implemented in the Linux kernel by correcting the locking and flag checking logic in the Thunderbolt driver. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, updating to the patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the input data; users should consult the vendor or Linux kernel advisory for the exact fixed versions and update instructions.