{"id":"CVE-2026-98692","kind":"vulnerability","aliases":["CVE-2026-98692"],"related":[],"title":"Linux kernel Thunderbolt: DP tunnel reference leak on hibernation restore","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Make the DP tunnel activation callback mandatory\n\ntb_tunnel_alloc_dp() takes an optional callback which is run from\ndprx_work once the DPRX capabilities read has completed. Without that\ncallback tb_dp_dprx_start() reads the capabilities synchronously and\nnever queues the work. It however always takes a tunnel reference which\nis only dropped by dprx_work itself or by tb_dp_dprx_stop() when\ncancel_delayed_work() actually canceled that work. That reference is\nthus leaked for every tunnel without a callback.\n\nThe only tunnels without one are those from tb_tunnel_discover_dp(),\nwhich are activated again when restoring from hibernation.\nPass the callback to tb_tunnel_discover_dp() as well and drop the\nsynchronous path such that the DPRX capabilities are always read from\ndprx_work. Hibernation restore then also no longer blocks for up to 12\nseconds while waiting for that read to complete.\n\nAlso fix up the KUnit tests.","summary":"In the Linux kernel's Thunderbolt driver, DisplayPort tunnels created without an activation callback leak a tunnel reference on every activation. The sources do not describe an attacker-facing effect beyond resource exhaustion and slower hibernation restore.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["laptops","linux-kernel","other","thunderbolt","workstations"],"not_affected_if":["driver-not-loaded","no-thunderbolt-hardware"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel release listed in the NVD entry for CVE-2026-98692.\n- Check whether Thunderbolt or USB4 hardware with DisplayPort tunnelling is present, for example with `boltctl list`.","fix":"- Update the Linux kernel to a release that includes the upstream commit resolving CVE-2026-98692 (version unknown from the sources).","status":"open","published_at":"2026-10-18T16:17:22+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:03+00:00","updated_at":"2026-10-25T05:19:03+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T05:19:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit resolving CVE-2026-98692 (version unknown from the sources).","reach":"local","title":"Linux kernel Thunderbolt: DP tunnel reference leak on hibernation restore","impact":"low","summary":"In the Linux kernel's Thunderbolt driver, DisplayPort tunnels created without an activation callback leak a tunnel reference on every activation. The sources do not describe an attacker-facing effect beyond resource exhaustion and slower hibernation restore.","category":"other","nicknames":[],"who_cares":["linux-kernel","thunderbolt","laptops","workstations"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources describe a reference leak and slower hibernation restore","analyst_note":"Confirm affected kernel version range and fixed release from the NVD entry and the upstream kernel commit; the sources give no severity or exploitability detail.","how_to_check":"- Run `uname -r` and compare against the fixed kernel release listed in the NVD entry for CVE-2026-98692.\n- Check whether Thunderbolt or USB4 hardware with DisplayPort tunnelling is present, for example with `boltctl list`.","needs_analyst":true,"not_affected_if":["no-thunderbolt-hardware","driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the Thunderbolt driver and DisplayPort tunnels, most likely laptops and workstations with Thunderbolt or USB4 ports that hibernate. Systems without Thunderbolt hardware or with the driver not loaded are unlikely to be affected. The sources do not state the affected kernel version range.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000678,"input_tokens":3576,"output_tokens":640,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98692':13A,16A '12':213C 'activ':36B,44B,77C,171C 'actual':142C 'alloc':82C 'also':206C,222C 'alway':119C,198C 'attack':52B 'attacker-fac':51B 'beyond':55B 'block':209C 'callback':37B,78C,87C,103C,156C,179C 'cancel':139C,143C 'capabl':97C,110C,196C 'complet':100C,221C 'creat':33B 'cve':11A,14A 'delay':140C 'describ':49B 'discov':167C,183C 'displayport':31B 'dp':4A,75C,83C,105C,135C,168C,184C 'dprx':92C,96C,106C,129C,136C,195C,201C 'driver':30B 'drop':127C,188C 'effect':54B 'everi':43B,152C 'exhaust':57B 'face':53B 'fix':223C 'follow':67C 'hibern':9A,60B,176C,203C 'howev':118C 'kernel':2A,20B,27B,65C 'kunit':226C 'laptop':17B 'leak':7A,38B,150C 'linux':1A,19B,26B,64C 'linux-kernel':18B 'longer':208C 'make':73C 'mandatori':79C 'never':113C 'one':161C 'option':86C 'pass':177C 'path':191C 'queue':114C 'read':98C,108C,199C,219C 'refer':6A,41B,123C,147C 'resolv':71C 'resourc':56B 'restor':10A,61B,174C,204C 'run':90C 'second':214C 'slower':59B 'sourc':46B 'start':107C 'stop':137C 'synchron':111C,190C 'take':84C,120C 'tb':80C,104C,134C,165C,181C 'test':227C 'thunderbolt':3A,22B,29B,72C 'thus':149C 'tunnel':5A,32B,40B,76C,81C,122C,153C,159C,166C,182C 'vulner':68C 'wait':216C 'well':186C 'without':34B,101C,154C,160C 'work':93C,116C,130C,141C,145C,202C 'workstat':23B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Thunderbolt driver and DisplayPort tunnels, most likely laptops and workstations with Thunderbolt or USB4 ports that hibernate. Systems without Thunderbolt hardware or with the driver not loaded are unlikely to be affected. The sources do not state the affected kernel version range.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98692","severity":null,"published_at":"2026-10-18T16:17:22+00:00","modified_at":"2026-10-19T10:19:33+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}