Live › vulnerability › CVE-2026-98689
Go to dashboardA race in the Linux kernel Thunderbolt driver lets a DisplayPort tunnel be accessed after its DPRX read was cancelled during suspend or shutdown. The sources do not state the exact effect beyond this access to a torn-down tunnel.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Thunderbolt driver and a DisplayPort tunnel over Thunderbolt, where the DPRX read never completes during suspend or teardown. The sources do not say which kernel versions are fixed or which hardware is most exposed. unknown
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Don't access a DP tunnel after its DPRX read was canceled
tb_dp_dprx_work() checks ->dprx_canceled before it takes tb->lock so it misses a tb_dp_dprx_stop() that could not cancel the already running work. It then polls the DPRX capabilities and runs the callback for a tunnel that has already been torn down while the domain is suspending or going away.
This can be hit by cancelling the DPRX read from outside the ordered tb->wq: During suspend tb_disconnect_and_release_dp() does just this and with a later patch tb_stop() will do it as well. The latter in combination with the Apple NHI where the DPRX read never completed is how I hit this.
Check the flag with tb->lock held instead and check it again in tb_dp_tunnel_active() because the callback runs after the lock has been dropped again.
Also clear the flag in tb_dp_dprx_start() so that it only ever describes the work that is currently in flight.
This page as .md · .json · in your agent: get_signal("CVE-2026-98689")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.