In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is canceled… (CVE-2026-98690)

The Linux kernel Thunderbolt driver had a flaw where tb_tunnel_one_dp() took a domain reference that was only released after tb_dp_tunnel_active() ran on a work queue. If that work was canceled, the reference was leaked. Following commit f5cc545f5969, this leak caused indefinite blocking during driver unbinding due to waiting on a completion that never occurred. The vulnerability can be triggered by tearing down a DP tunnel before the DPRX read completes, for example by unplugging within the timeout window. The fix reassigns the domain reference ownership to tb_dp_dprx_start() and ensures paired get/put calls within the same file, preventing leaks and blocking.

The vulnerability causes a resource leak and indefinite blocking during driver unbinding, which can lead to system instability or denial of service conditions when unplugging Thunderbolt devices with active DP tunnels. There is no indication of code execution or privilege escalation. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this issue by properly managing the domain reference lifecycle. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level issue, applying the official kernel update is the recommended remediation.