{"id":"CVE-2026-98690","kind":"vulnerability","aliases":["CVE-2026-98690"],"related":[],"title":"Linux kernel Thunderbolt: leaked domain reference hangs driver unbind","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Fix domain reference leak when DPRX read is canceled\n\ntb_tunnel_one_dp() takes a domain reference which is only dropped once\ntb_dp_tunnel_active() has run on the work queue. If that work is\ncancelled that reference is leaked. Since\ncommit f5cc545f5969 (\"thunderbolt: Wait for tb_domain_release() to\ncomplete when driver is removed\") instead of just leaking memory this\nnow also blocks in the completion wait forever when unbinding the\ndriver.\n\nThis can be triggered whenever a DP tunnel is torn down before the DPRX\nread has completed, e.g. by unplugging within the timeout, and then\nunbinding the driver.\n\nThat reference only exists to keep the domain around while the DPRX work\nis scheduled so let the work itself own it: take it in tb_dp_dprx_start()\nand drop it in both places that end the work. Get/put are then paired\ninside the same file and it doesn't matter anymore if the callback ever\nruns.","summary":"When a DisplayPort tunnel is torn down before its DPRX read finishes, the Thunderbolt driver leaks a reference to the domain. Unbinding the driver then blocks forever in a completion wait, which hangs the machine's Thunderbolt handling.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","laptops","linux","runtime","thunderbolt","usb4"],"not_affected_if":["no-thunderbolt-hardware","thunderbolt-driver-not-loaded"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel in the advisory (unknown in the sources)\n- Check whether Thunderbolt hardware is present with `lspci | grep -i thunderbolt` or `boltctl list`","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing the domain reference leak in the thunderbolt driver (fixed version unknown in the sources)","status":"open","published_at":"2026-10-18T16:17:22+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:06+00:00","updated_at":"2026-10-25T05:19:06+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:19:06Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing the domain reference leak in the thunderbolt driver (fixed version unknown in the sources)","reach":"local","title":"Linux kernel Thunderbolt: leaked domain reference hangs driver unbind","impact":"low","summary":"When a DisplayPort tunnel is torn down before its DPRX read finishes, the Thunderbolt driver leaks a reference to the domain. Unbinding the driver then blocks forever in a completion wait, which hangs the machine's Thunderbolt handling.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","thunderbolt","usb4","laptops"],"confidence":0.6,"needs_auth":"unknown","worst_case":"driver unbind hangs forever; denial of service only","analyst_note":"Check the upstream kernel commit and stable backport version for the thunderbolt domain reference fix; see the NVD entry for the CVE-2026-98690 fixed-version list.","how_to_check":"- Run `uname -r` and compare against the fixed kernel in the advisory (unknown in the sources)\n- Check whether Thunderbolt hardware is present with `lspci | grep -i thunderbolt` or `boltctl list`","needs_analyst":true,"not_affected_if":["no-thunderbolt-hardware","thunderbolt-driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with Thunderbolt support and DisplayPort tunnelling, such as laptops and workstations with Thunderbolt or USB4 ports. Servers and machines without Thunderbolt hardware are unlikely to load this driver and can skip it. The bug needs a DP tunnel torn down mid-read and then a driver unbind, so a plain attacker on the internet has no obvious path.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000692,"input_tokens":3570,"output_tokens":671,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-98690':12A,15A 'activ':96C 'also':134C 'anymor':225C 'around':181C 'block':47B,135C 'callback':228C 'cancel':79C,107C 'commit':113C 'complet':51B,122C,138C,161C 'cve':10A,13A 'displayport':24B 'doesn':222C 'domain':5A,42B,72C,86C,119C,180C 'dp':83C,94C,151C,199C 'dprx':31B,76C,158C,184C,200C 'driver':8A,36B,45B,124C,144C,172C 'drop':91C,203C 'e.g':162C 'end':209C 'ever':229C 'exist':176C 'f5cc545f5969':114C 'file':219C 'finish':33B 'fix':71C 'follow':65C 'forev':48B,140C 'get/put':212C 'handl':59B 'hang':7A,54B 'insid':216C 'instead':127C 'keep':178C 'kernel':2A,16B,63C 'laptop':17B 'leak':4A,37B,74C,111C,130C 'let':189C 'linux':1A,18B,62C 'machin':56B 'matter':224C 'memori':131C 'one':82C 'pair':215C 'place':207C 'queue':102C 'read':32B,77C,159C 'refer':6A,39B,73C,87C,109C,174C 'releas':120C 'remov':126C 'resolv':69C 'run':98C,230C 'runtim':19B 'schedul':187C 'sinc':112C 'start':201C 'take':84C,195C 'tb':80C,93C,118C,198C 'thunderbolt':3A,20B,35B,58B,70C,115C 'timeout':167C 'torn':27B,154C 'trigger':148C 'tunnel':25B,81C,95C,152C 'unbind':9A,43B,142C,170C 'unplug':164C 'usb4':21B 'vulner':66C 'wait':52B,116C,139C 'whenev':149C 'within':165C 'work':101C,105C,185C,191C,211C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with Thunderbolt support and DisplayPort tunnelling, such as laptops and workstations with Thunderbolt or USB4 ports. Servers and machines without Thunderbolt hardware are unlikely to load this driver and can skip it. The bug needs a DP tunnel torn down mid-read and then a driver unbind, so a plain attacker on the internet has no obvious path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98690","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98690","severity":null,"published_at":"2026-10-18T16:17:22+00:00","modified_at":"2026-10-19T10:19:33+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}