CVE-2026-98694 - Vulnerability Details

- thunderbolt: Fix KASAN reported use-after-free when request is canceled

Description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Fix KASAN reported use-after-free when request is canceled

Alan reported that when doing stress testing sometimes KASAN notices
use-after-free during control channel operation (stripped down keeping
the relevant parts):

BUG: KASAN: slab-use-after-free in tb_cfg_request_sync+0x240/0x250 [thunderbolt]
Read of size 24 at addr ffff88811067f290 by task kworker/u40:2/1760
<TASK>
tb_cfg_request_sync+0x240/0x250 [thunderbolt]
tb_cfg_read_raw+0x367/0x510 [thunderbolt]
tb_cfg_read+0xec/0x240 [thunderbolt]
tb_port_get_link_generation+0x258/0x420 [thunderbolt]
tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt]
tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt]
tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt]
tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt]
tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt]
process_one_work+0x675/0x1230
worker_thread+0x5e6/0xf70
kthread+0x365/0x470
ret_from_fork+0x54d/0x710
ret_from_fork_asm+0x1a/0x30
</TASK>

Allocated by task 1760:
__kmalloc_cache_noprof+0x1ee/0x550
tb_cfg_read_raw+0x1d3/0x510 [thunderbolt]
tb_cfg_read+0xec/0x240 [thunderbolt]
tb_port_get_link_generation+0x258/0x420 [thunderbolt]
tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt]
tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt]
tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt]
tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt]
tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt]
process_one_work+0x675/0x1230
worker_thread+0x5e6/0xf70
kthread+0x365/0x470
ret_from_fork+0x54d/0x710
ret_from_fork_asm+0x1a/0x30

Freed by task 926:
kfree+0x18f/0x4a0
tb_cfg_request_put+0xb7/0xe0 [thunderbolt]
tb_cfg_request_work+0x82/0x120 [thunderbolt]
process_one_work+0x675/0x1230
worker_thread+0x5e6/0xf70
kthread+0x365/0x470
ret_from_fork+0x54d/0x710
ret_from_fork_asm+0x1a/0x30

Second to last potentially related work creation:
__queue_work+0x575/0xd00
queue_work_on+0x77/0x80
tb_cfg_request_cancel+0xc7/0x260 [thunderbolt]
tb_cfg_request_sync+0x1f6/0x250 [thunderbolt]
tb_cfg_read_raw+0x367/0x510 [thunderbolt]
tb_cfg_read+0xec/0x240 [thunderbolt]
tb_port_get_link_generation+0x258/0x420 [thunderbolt]
tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt]
tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt]
tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt]
tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt]
tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt]
process_one_work+0x675/0x1230
worker_thread+0x5e6/0xf70
kthread+0x365/0x470
ret_from_fork+0x54d/0x710
ret_from_fork_asm+0x1a/0x30

The last stack trace is helpful because it shows that we are cancelling
a request and looking at tb_cfg_request_cancel() what might happen is
that tb_cfg_request_work() completes right before tb_cfg_request_cancel()
starts and because of this it will call schedule_work() queueing the
same work to run again. However, it is already removed from the
request_queue and reference count is dropped so when
tb_cfg_request_work() triggers again it will access memory that is
already released.

Fix this so that we first make sure a cancelled request is not handed
away from tb_cfg_request_find() or scheduled to run. Then instead of
relying on the worker to clean up the request we will do it in
tb_cfg_request_cancel() after the work is canceled from running. Make
tb_cfg_request_dequeue() release the request only if it was actually
removed from the queue.

Published: 2026-10-18

Score: 4.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

During stress testing of the Linux kernel Thunderbolt driver, a use‑after‑free condition was observed when control channel requests were canceled. The freed request structure was accessed again by the workqueue, causing memory corruption that could culminate in a crash or, if an attacker can influence the payload, remote code execution. This flaw involves a use‑after‑free (CWE‑416) and memory corruption due to race conditions (CWE‑825).

Affected Systems

The vulnerability affects the Thunderbolt driver in the Linux kernel. All Linux kernel releases prior to receiving the patch that addresses the control channel request cancellation logic are potentially vulnerable. The exact affected versions are not listed, but any kernel containing the problematic code path is at risk.

Risk and Exploitability

The CVSS score is 4.7 and the EPSS score is <1 %. The attacker would need either local kernel write access or the ability to manipulate Thunderbolt requests, which is typically limited but not impossible in environments with exposed Thunderbolt devices. The vulnerability is not listed in CISA KEV and no public exploit is known as of now.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1`	affected	< 94358146389d985b809898cc23b1030ff240a25d
`d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1`	affected	< 9594550e95bcc362027b7ad5f0d5665110f8a7d8
`d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1`	affected	< 0dc4296ac0910d3a43d9e105226ace463e475304
`d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1`	affected	< b70b9c41f240c42bf6e728034537c0fe60c16ef4
`d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1`	affected	< 71b3c517e02af2c46ad58d4b3706b7c3cb24936d
`d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1`	affected	< f18faa3d3b810d60a3005ae1b1d1866faa67d343
`d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1`	affected	< 08287212b622039212c972806f896f078dfd28e2
`d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1`	affected	< a02188ddc24b7872f0c5e0c5873f827318717803

Linux

affected

Version	Status	Constraints
`4.13`	affected	—
`0`	unaffected	< 4.13
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1,71b3c517e02af2c46ad58d4b3706b7c3cb24936d)`	affected	code_commit	—
`[d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1,f18faa3d3b810d60a3005ae1b1d1866faa67d343)`	affected	code_commit	—
`[d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1,08287212b622039212c972806f896f078dfd28e2)`	affected	code_commit	—
`[d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1,a02188ddc24b7872f0c5e0c5873f827318717803)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.13`	affected	generic	—
`[0,4.13)`	unaffected	generic	—
`[6.12.113,6.13.0.0)`	unaffected	generic	—
`[6.18.56,6.19.0.0)`	unaffected	generic	—
`[7.2.10,7.3.0.0)`	unaffected	generic	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a Linux kernel release that includes the patch for the Thunderbolt use‑after‑free issue.
If an immediate kernel upgrade is not feasible, disable the Thunderbolt driver by blacklisting it or using a kernel boot option such as `blacklist thunderbolt` or `nothunderbolt` to prevent the driver from loading.
Reboot the system after making changes to ensure the updated driver or the disabled state takes effect.

Generated by OpenCVE AI on October 22, 2026 at 20:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98694.mbox
https://git.kernel.org/stable/c/08287212b622039212c972806f896f078dfd28e2
https://git.kernel.org/stable/c/0dc4296ac0910d3a43d9e105226ace463e475304
https://git.kernel.org/stable/c/71b3c517e02af2c46ad58d4b3706b7c3cb24936d
https://git.kernel.org/stable/c/94358146389d985b809898cc23b1030ff240a25d
https://git.kernel.org/stable/c/9594550e95bcc362027b7ad5f0d5665110f8a7d8
https://git.kernel.org/stable/c/a02188ddc24b7872f0c5e0c5873f827318717803
https://git.kernel.org/stable/c/b70b9c41f240c42bf6e728034537c0fe60c16ef4
https://git.kernel.org/stable/c/f18faa3d3b810d60a3005ae1b1d1866faa67d343
https://nvd.nist.gov/vuln/detail/CVE-2026-98694
https://www.cve.org/CVERecord?id=CVE-2026-98694

History

Fri, 30 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0dc4296ac0910d3a43d9e105226ace463e475304 https://git.kernel.org/stable/c/94358146389d985b809898cc23b1030ff240a25d https://git.kernel.org/stable/c/9594550e95bcc362027b7ad5f0d5665110f8a7d8

Thu, 22 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98694.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98694 https://www.cve.org/CVERecord?id=CVE-2026-98694
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/b70b9c41f240c42bf6e728034537c0fe60c16ef4

Sun, 18 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation (stripped down keeping the relevant parts): BUG: KASAN: slab-use-after-free in tb_cfg_request_sync+0x240/0x250 [thunderbolt] Read of size 24 at addr ffff88811067f290 by task kworker/u40:2/1760 <TASK> tb_cfg_request_sync+0x240/0x250 [thunderbolt] tb_cfg_read_raw+0x367/0x510 [thunderbolt] tb_cfg_read+0xec/0x240 [thunderbolt] tb_port_get_link_generation+0x258/0x420 [thunderbolt] tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt] tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt] tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt] tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt] tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt] process_one_work+0x675/0x1230 worker_thread+0x5e6/0xf70 kthread+0x365/0x470 ret_from_fork+0x54d/0x710 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1760: __kmalloc_cache_noprof+0x1ee/0x550 tb_cfg_read_raw+0x1d3/0x510 [thunderbolt] tb_cfg_read+0xec/0x240 [thunderbolt] tb_port_get_link_generation+0x258/0x420 [thunderbolt] tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt] tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt] tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt] tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt] tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt] process_one_work+0x675/0x1230 worker_thread+0x5e6/0xf70 kthread+0x365/0x470 ret_from_fork+0x54d/0x710 ret_from_fork_asm+0x1a/0x30 Freed by task 926: kfree+0x18f/0x4a0 tb_cfg_request_put+0xb7/0xe0 [thunderbolt] tb_cfg_request_work+0x82/0x120 [thunderbolt] process_one_work+0x675/0x1230 worker_thread+0x5e6/0xf70 kthread+0x365/0x470 ret_from_fork+0x54d/0x710 ret_from_fork_asm+0x1a/0x30 Second to last potentially related work creation: __queue_work+0x575/0xd00 queue_work_on+0x77/0x80 tb_cfg_request_cancel+0xc7/0x260 [thunderbolt] tb_cfg_request_sync+0x1f6/0x250 [thunderbolt] tb_cfg_read_raw+0x367/0x510 [thunderbolt] tb_cfg_read+0xec/0x240 [thunderbolt] tb_port_get_link_generation+0x258/0x420 [thunderbolt] tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt] tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt] tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt] tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt] tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt] process_one_work+0x675/0x1230 worker_thread+0x5e6/0xf70 kthread+0x365/0x470 ret_from_fork+0x54d/0x710 ret_from_fork_asm+0x1a/0x30 The last stack trace is helpful because it shows that we are cancelling a request and looking at tb_cfg_request_cancel() what might happen is that tb_cfg_request_work() completes right before tb_cfg_request_cancel() starts and because of this it will call schedule_work() queueing the same work to run again. However, it is already removed from the request_queue and reference count is dropped so when tb_cfg_request_work() triggers again it will access memory that is already released. Fix this so that we first make sure a cancelled request is not handed away from tb_cfg_request_find() or scheduled to run. Then instead of relying on the worker to clean up the request we will do it in tb_cfg_request_cancel() after the work is canceled from running. Make tb_cfg_request_dequeue() release the request only if it was actually removed from the queue.
Title		thunderbolt: Fix KASAN reported use-after-free when request is canceled
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/08287212b622039212c972806f896f078dfd28e2 https://git.kernel.org/stable/c/71b3c517e02af2c46ad58d4b3706b7c3cb24936d https://git.kernel.org/stable/c/a02188ddc24b7872f0c5e0c5873f827318717803 https://git.kernel.org/stable/c/f18faa3d3b810d60a3005ae1b1d1866faa67d343

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:46:18.654Z

Updated: 2026-10-30T12:38:46.335Z

Reserved: 2026-09-25T10:25:14.364Z

Link: CVE-2026-98694

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:22.830

Modified: 2026-10-30T13:21:18.383

Link: CVE-2026-98694

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98694 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-22T21:00:08Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object