In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tb_stop()… (CVE-2026-98691)

The vulnerability in the Linux kernel Thunderbolt driver stemmed from tb_stop() only tearing down DMA tunnels, while inactive DP tunnels waiting for dprx_work completion remained queued. This caused the flush_workqueue() in tb_domain_remove() to not wait for the final run of the work, leading to callbacks running against a domain already torn down. Additionally, a reference to the domain was kept, causing blocking until a timeout was reached. The fix involves tearing down inactive DP tunnels as well, canceling the queued work and preventing callbacks on torn down domains, while leaving active display tunnels operational.

This flaw could cause the kernel to execute callbacks against a domain that has already been torn down, potentially leading to use-after-free conditions or blocking behavior until a timeout occurs. However, no active exploits are known, and the issue affects internal kernel operations related to Thunderbolt DP tunnels.

A fix has been implemented in the Linux kernel to properly tear down inactive DP tunnels when the domain is stopped, canceling queued work and preventing callbacks on torn down domains. Users should update to the fixed kernel version once available. No additional mitigation steps are indicated.