In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tb_stop() drops… (CVE-2026-98693)

The Linux kernel Thunderbolt driver had a vulnerability where tb_stop() dropped references to DP tunnels without deactivating them, allowing dprx_work to remain active and hold tunnel references beyond the removal of tb_switch. This caused HopID releases in tb_path_free() to operate on freed IDAs, triggering warnings such as 'ida_free called for id=8 which is not allocated.' The issue can be triggered by unbinding the driver while a DP tunnel is waiting for DPRX capabilities read completion, especially on Apple NHI devices during cable unplug events. The resolution is to hold a router reference for each allocated HopID and release it only after the HopID is freed, ensuring ports and HopID IDAs remain valid while in use. Additional fixes were made to KUnit tests to properly initialize and release embedded struct devices.

The vulnerability can cause kernel warnings and potential instability due to operations on freed IDAs when DP tunnels outlive their expected lifecycle. This can occur during driver unbinding while DP tunnels are still active, potentially leading to resource management issues in the Thunderbolt subsystem. There is no indication of direct code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to hold router references for each allocated HopID and properly release them after use, preventing the use-after-free condition. Users and administrators should apply the official Linux kernel updates that include this fix. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation. No additional mitigation steps are indicated by the vendor advisory.