Description
In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Make the DP tunnel activation callback mandatory

tb_tunnel_alloc_dp() takes an optional callback which is run from
dprx_work once the DPRX capabilities read has completed. Without that
callback tb_dp_dprx_start() reads the capabilities synchronously and
never queues the work. It however always takes a tunnel reference which
is only dropped by dprx_work itself or by tb_dp_dprx_stop() when
cancel_delayed_work() actually canceled that work. That reference is
thus leaked for every tunnel without a callback.

The only tunnels without one are those from tb_tunnel_discover_dp(),
which are activated again when restoring from hibernation.
Pass the callback to tb_tunnel_discover_dp() as well and drop the
synchronous path such that the DPRX capabilities are always read from
dprx_work. Hibernation restore then also no longer blocks for up to 12
seconds while waiting for that read to complete.

Also fix up the KUnit tests.
Published: 2026-10-18
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via leaked reference
Action: Apply Patch
AI Analysis

Impact

In the Linux kernel, the Thunderbolt DP tunnel allocation routine can omit a mandatory callback, causing the reference counter for a tunnel to never be released. Each tunnel that is created without this callback leaks a kernel reference, which can accumulate and exhaust memory or degrade performance. The consequence is a kernel‑level resource exhaustion that may lead to system instability or refusal of normal operations. The weakness is listed as CWE‑911.

Affected Systems

All Linux kernel installations that include the Thunderbolt DP tunnel driver are susceptible. The affected CPE is cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*.*. No specific kernel version numbers are documented; the problem persists until the kernel incorporates the fix found in the referenced commits.

Risk and Exploitability

The CVSS score of 2.3 indicates low severity and the EPSS score of <1% shows a very low probability of exploitation. The bug can only be triggered by privileged or local execution that exercises the Thunderbolt DP tunnel allocation logic, such as connecting a DP device or restoring from hibernation. It is not listed in CISA's KEV catalog. The overall risk is confined to potential resource exhaustion and deferred hibernation, making it a low‑impact threat unless an attacker can repeatedly trigger the allocation path.

Generated by OpenCVE AI on October 23, 2026 at 05:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a Linux kernel revision that incorporates the patch commits 12f5d8b85a66a0ac08d082517d92ce136f8c0d42 and 47d60ea801fc333a10c576691eca2e7840b02d3d
  • Reboot the system after applying the updated kernel to activate the changes
  • If an immediate kernel upgrade is not possible, disable Thunderbolt support or the DP tunnel features to prevent the resource leak until a fix can be applied

Generated by OpenCVE AI on October 23, 2026 at 05:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
References

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-401
CWE-795

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-911
References
Metrics threat_severity

None

 cvssV3_1

{'score': 2.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L'}

threat_severity

Low

Sun, 18 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-401
CWE-795

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Make the DP tunnel activation callback mandatory tb_tunnel_alloc_dp() takes an optional callback which is run from dprx_work once the DPRX capabilities read has completed. Without that callback tb_dp_dprx_start() reads the capabilities synchronously and never queues the work. It however always takes a tunnel reference which is only dropped by dprx_work itself or by tb_dp_dprx_stop() when cancel_delayed_work() actually canceled that work. That reference is thus leaked for every tunnel without a callback. The only tunnels without one are those from tb_tunnel_discover_dp(), which are activated again when restoring from hibernation. Pass the callback to tb_tunnel_discover_dp() as well and drop the synchronous path such that the DPRX capabilities are always read from dprx_work. Hibernation restore then also no longer blocks for up to 12 seconds while waiting for that read to complete. Also fix up the KUnit tests.
Title thunderbolt: Make the DP tunnel activation callback mandatory
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-11-06T17:15:04.213Z

Reserved: 2026-09-25T10:25:14.364Z

Link: CVE-2026-98692

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:22.623

Modified: 2026-11-06T18:18:29.917

Link: CVE-2026-98692

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98692 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T05:15:14Z

Weaknesses
  • CWE-911

    Improper Update of Reference Count