Live › vulnerability › CVE-2026-98692
Go to dashboardIn the Linux kernel's Thunderbolt driver, DisplayPort tunnels created without an activation callback leak a tunnel reference on every activation. The sources do not describe an attacker-facing effect beyond resource exhaustion and slower hibernation restore.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Thunderbolt driver and DisplayPort tunnels, most likely laptops and workstations with Thunderbolt or USB4 ports that hibernate. Systems without Thunderbolt hardware or with the driver not loaded are unlikely to be affected. The sources do not state the affected kernel version range.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel release listed in the NVD entry for CVE-2026-98692.boltctl list.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Make the DP tunnel activation callback mandatory
tb_tunnel_alloc_dp() takes an optional callback which is run from dprx_work once the DPRX capabilities read has completed. Without that callback tb_dp_dprx_start() reads the capabilities synchronously and never queues the work. It however always takes a tunnel reference which is only dropped by dprx_work itself or by tb_dp_dprx_stop() when cancel_delayed_work() actually canceled that work. That reference is thus leaked for every tunnel without a callback.
The only tunnels without one are those from tb_tunnel_discover_dp(), which are activated again when restoring from hibernation. Pass the callback to tb_tunnel_discover_dp() as well and drop the synchronous path such that the DPRX capabilities are always read from dprx_work. Hibernation restore then also no longer blocks for up to 12 seconds while waiting for that read to complete.
Also fix up the KUnit tests.
This page as .md · .json · in your agent: get_signal("CVE-2026-98692")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.