In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tb_remove_work() There is a slight race… (CVE-2026-98688)

The vulnerability involves a race condition between tb_remove_work() and tb_domain_remove() in the Linux kernel Thunderbolt subsystem. tb_domain_remove() sets tb->root_switch to NULL while holding a lock, but tb_remove_work() calls tb_free_unplugged_xdomains(tb->root_switch) without holding the lock or checking if tb->root_switch is NULL. This leads to a NULL pointer dereference. The root cause is the movement of tb_free_unplugged_xdomains() outside the locked section in a prior commit, which violated locking requirements. The flaw was detected by the Linux Verification Center using the Svace static analysis tool.

The vulnerability causes a NULL pointer dereference in kernel code, which can lead to a kernel crash (denial of service). There is no indication of code execution or privilege escalation. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to restore proper locking and NULL checks around tb_free_unplugged_xdomains(). Users should update to the fixed kernel version once available. Patch status is not explicitly stated in the provided data; check the vendor advisory or Linux kernel mailing lists for the official fix and version details.