{"id":"CVE-2026-98688","kind":"vulnerability","aliases":["CVE-2026-98688"],"related":[],"title":"Linux kernel: Thunderbolt race can dereference a NULL root switch pointer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Fix NULL dereference in tb_remove_work()\n\nThere is a slight race between tb_remove_work() and tb_domain_remove()\nwhich leads to dereferencing a NULL tb->root_switch pointer inside\ntb_free_unplugged_xdomains():\n\n        Thread A                            Thread B\n\n  tb_remove_work()\n                                    tb_domain_remove()\n                                      mutex_lock(&tb->lock)\n                                      tb_stop()\n                                        /* doesn't cancel a running callback */\n                                        cancel_delayed_work(&tcm->remove_work)\n                                        ...\n                                        tb_switch_remove(tb->root_switch)\n                                        tb->root_switch = NULL\n                                      mutex_unlock(&tb->lock)\n    mutex_lock(&tb->lock)\n    ...\n    /* without checking ->root_switch */\n    tb_free_unplugged_xdomains(tb->root_switch)\n    mutex_unlock(&tb->lock)\n\nCommit a8937f35cf39 (\"thunderbolt: Remove XDomain from the bus without\nholding tb->lock\") doesn't seem right to move tb_free_unplugged_xdomains()\nout of the &tb->lock section and the check for tb->root_switch, in\nparticular.  It states:\n\n  For this reason separate removing the XDomain from the topology data\n  structures (where we need the lock) from unregistering the device from\n  the bus (where remove callbacks of the drivers are being called).\n\ntb_free_unplugged_xdomains() belongs to the former group of functions\nrequiring the lock.  And it also calls tb_xdomain_remove() which should\nonly be called with &tb->lock held.\n\nFound by Linux Verification Center (linuxtesting.org) with Svace static\nanalysis tool.","summary":"A race between the Thunderbolt removal work and domain teardown in the Linux kernel can dereference a NULL root switch pointer, causing a crash. The sources describe a kernel NULL dereference and do not state a code-execution or data-exposure impact.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","laptops","linux-kernel","thunderbolt","workstations"],"not_affected_if":["no-thunderbolt-hardware"],"how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the Thunderbolt driver is loaded with `lsmod | grep thunderbolt`\n- Compare the running kernel against the fixed version in the kernel stable advisory, which the sources do not name","fix":"- Install a Linux kernel build that contains the upstream commit that fixes tb_remove_work() by holding tb->lock and checking tb->root_switch; the exact fixed version is unknown from the sources\n- Reboot into the patched kernel","status":"open","published_at":"2026-10-18T16:17:22+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:07+00:00","updated_at":"2026-10-25T05:19:07+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:19:07Z","model":"claude-haiku-5-5","output":{"fix":"- Install a Linux kernel build that contains the upstream commit that fixes tb_remove_work() by holding tb->lock and checking tb->root_switch; the exact fixed version is unknown from the sources\n- Reboot into the patched kernel","reach":"local","title":"Linux kernel: Thunderbolt race can dereference a NULL root switch pointer","impact":"low","summary":"A race between the Thunderbolt removal work and domain teardown in the Linux kernel can dereference a NULL root switch pointer, causing a crash. The sources describe a kernel NULL dereference and do not state a code-execution or data-exposure impact.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","thunderbolt","laptops","workstations"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel NULL dereference crashes the system","analyst_note":"Check the kernel.org stable commit for a8937f35cf39 follow-up and the fixed kernel versions per branch; sources give no CVSS or version ranges.","how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the Thunderbolt driver is loaded with `lsmod | grep thunderbolt`\n- Compare the running kernel against the fixed version in the kernel stable advisory, which the sources do not name","needs_analyst":true,"not_affected_if":["no-thunderbolt-hardware"],"who_is_affected":"Systems running a Linux kernel with the Thunderbolt driver, typically laptops and workstations with Thunderbolt ports or docks that hot-unplug or tear down Thunderbolt domains. The race needs domain removal to overlap with the removal work, so impact on servers without Thunderbolt hardware is unknown but likely minimal.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000712,"input_tokens":3831,"output_tokens":658,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98688':14A,17A 'a8937f35cf39':177C 'also':264C 'analysi':287C 'b':118C 'belong':252C 'bus':183C,238C 'call':247C,265C,273C 'callback':136C,241C 'cancel':133C,137C 'caus':46B 'center':282C 'check':162C,206C 'code':62B 'code-execut':61B 'commit':176C 'crash':48B 'cve':12A,15A 'data':66B,225C 'data-exposur':65B 'delay':138C 'derefer':6A,40B,55B,82C 'dereferenc':103C 'describ':51B 'devic':235C 'doesn':131C,188C 'domain':33B,98C,123C 'driver':244C 'execut':63B 'exposur':67B 'fix':80C 'follow':74C 'former':255C 'found':278C 'free':112C,166C,195C,249C 'function':258C 'group':256C 'held':277C 'hold':185C 'impact':68B 'infrastructur':18B 'insid':110C 'kernel':2A,22B,38B,53B,72C 'laptop':19B 'lead':101C 'linux':1A,21B,37B,71C,280C 'linux-kernel':20B 'linuxtesting.org':283C 'lock':126C,128C,156C,158C,160C,175C,187C,202C,231C,261C,276C 'move':193C 'mutex':125C,153C,157C,172C 'need':229C 'null':8A,42B,54B,81C,105C,152C 'particular':212C 'pointer':11A,45B,109C 'race':4A,26B,91C 'reason':217C 'remov':30B,85C,94C,99C,120C,124C,141C,145C,179C,219C,240C,268C 'requir':259C 'resolv':78C 'right':191C 'root':9A,43B,107C,147C,150C,163C,170C,209C 'run':135C 'section':203C 'seem':190C 'separ':218C 'slight':90C 'sourc':50B 'state':59B,214C 'static':286C 'stop':130C 'structur':226C 'svace':285C 'switch':10A,44B,108C,144C,148C,151C,164C,171C,210C 'tb':84C,93C,97C,106C,111C,119C,122C,127C,129C,143C,146C,149C,155C,159C,165C,169C,174C,186C,194C,201C,208C,248C,266C,275C 'tcm':140C 'teardown':34B 'thread':115C,117C 'thunderbolt':3A,23B,29B,79C,178C 'tool':288C 'topolog':224C 'unlock':154C,173C 'unplug':113C,167C,196C,250C 'unregist':233C 'verif':281C 'vulner':75C 'without':161C,184C 'work':31B,86C,95C,121C,139C,142C 'workstat':24B 'xdomain':114C,168C,180C,197C,221C,251C,267C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Thunderbolt driver, typically laptops and workstations with Thunderbolt ports or docks that hot-unplug or tear down Thunderbolt domains. The race needs domain removal to overlap with the removal work, so impact on servers without Thunderbolt hardware is unknown but likely minimal.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98688","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98688","severity":null,"published_at":"2026-10-18T16:17:22+00:00","modified_at":"2026-10-19T10:19:33+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}