In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan… (CVE-2026-98694)

The vulnerability in the Linux kernel thunderbolt driver involves a use-after-free condition detected by KASAN during stress testing. Specifically, when a control channel request is canceled, the work associated with the request may be rescheduled and executed again after the memory has been freed, causing a use-after-free. The root cause is that tb_cfg_request_work() can be triggered after tb_cfg_request_cancel() starts, leading to access of freed memory. The fix prevents canceled requests from being handed out or scheduled and moves cleanup to tb_cfg_request_cancel() after canceling the work, ensuring no use-after-free occurs.

This use-after-free vulnerability could lead to kernel memory corruption, potentially causing system instability or crashes. However, no known exploits are reported in the wild. The impact is limited to the Linux kernel thunderbolt driver during specific control channel operations involving request cancellation.

A fix has been implemented in the Linux kernel to address this use-after-free issue in the thunderbolt driver. Users and administrators should update to the fixed kernel version once it is released. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories or vendor updates for the specific patch and remediation guidance.