In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process… (CVE-2026-98896)

The vulnerability in the Linux kernel's Thunderbolt subsystem involved processing hotplug events in a workqueue that might execute after the associated domain was removed via tb_domain_remove(). This race condition could cause a use-after-free scenario if a user unloaded the driver while plugging in a device router, leading to the scheduled tb_handle_hotplug() running on a freed domain reference. The patch addresses this by acquiring a domain reference before scheduling the hotplug handler in tb_queue_hotplug(), preventing the use-after-free condition.

The vulnerability could lead to use-after-free memory access in the Linux kernel's Thunderbolt hotplug processing, which may cause kernel instability or potential escalation of privileges if exploited. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this vulnerability by ensuring the domain reference is held while processing hotplug events. Users should update to the patched kernel versions once available. No additional mitigations are specified.