{"id":"CVE-2026-98694","kind":"vulnerability","aliases":["CVE-2026-98694"],"related":[],"title":"Linux kernel Thunderbolt: use-after-free when a control request is canceled","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Fix KASAN reported use-after-free when request is canceled\n\nAlan reported that when doing stress testing sometimes KASAN notices\nuse-after-free during control channel operation (stripped down keeping\nthe relevant parts):\n\n BUG: KASAN: slab-use-after-free in tb_cfg_request_sync+0x240/0x250 [thunderbolt]\n Read of size 24 at addr ffff88811067f290 by task kworker/u40:2/1760\n  <TASK>\n  tb_cfg_request_sync+0x240/0x250 [thunderbolt]\n  tb_cfg_read_raw+0x367/0x510 [thunderbolt]\n  tb_cfg_read+0xec/0x240 [thunderbolt]\n  tb_port_get_link_generation+0x258/0x420 [thunderbolt]\n  tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt]\n  tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt]\n  tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt]\n  tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt]\n  tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n  </TASK>\n\n Allocated by task 1760:\n  __kmalloc_cache_noprof+0x1ee/0x550\n  tb_cfg_read_raw+0x1d3/0x510 [thunderbolt]\n  tb_cfg_read+0xec/0x240 [thunderbolt]\n  tb_port_get_link_generation+0x258/0x420 [thunderbolt]\n  tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt]\n  tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt]\n  tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt]\n  tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt]\n  tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n\n Freed by task 926:\n  kfree+0x18f/0x4a0\n  tb_cfg_request_put+0xb7/0xe0 [thunderbolt]\n  tb_cfg_request_work+0x82/0x120 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n\n Second to last potentially related work creation:\n  __queue_work+0x575/0xd00\n  queue_work_on+0x77/0x80\n  tb_cfg_request_cancel+0xc7/0x260 [thunderbolt]\n  tb_cfg_request_sync+0x1f6/0x250 [thunderbolt]\n  tb_cfg_read_raw+0x367/0x510 [thunderbolt]\n  tb_cfg_read+0xec/0x240 [thunderbolt]\n  tb_port_get_link_generation+0x258/0x420 [thunderbolt]\n  tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt]\n  tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt]\n  tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt]\n  tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt]\n  tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n\nThe last stack trace is helpful because it shows that we are cancelling\na request and looking at tb_cfg_request_cancel() what might happen is\nthat tb_cfg_request_work() completes right before tb_cfg_request_cancel()\nstarts and because of this it will call schedule_work() queueing the\nsame work to run again. However, it is already removed from the\nrequest_queue and reference count is dropped so when\ntb_cfg_request_work() triggers again it will access memory that is\nalready released.\n\nFix this so that we first make sure a cancelled request is not handed\naway from tb_cfg_request_find() or scheduled to run. Then instead of\nrelying on the worker to clean up the request we will do it in\ntb_cfg_request_cancel() after the work is canceled from running. Make\ntb_cfg_request_dequeue() release the request only if it was actually\nremoved from the queue.","summary":"A race in the Linux kernel Thunderbolt control channel can let a canceled configuration request be queued again after its memory is freed, which KASAN reports as a use-after-free. The sources do not describe a confirmed attacker-controlled exploit path, so the practical impact is a kernel memory-safety bug reachable through Thunderbolt bandwidth handling.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","other","self-hosted","thunderbolt"],"not_affected_if":["module-not-loaded","no-thunderbolt-hardware"],"how_to_check":"- Run `uname -r` and compare against the kernel version that carries the upstream fix, which the sources do not list.\n- Check whether the `thunderbolt` module is loaded with `lsmod | grep thunderbolt`.\n- Confirm the fix commit in your distribution's kernel changelog, since the sources do not give fixed versions.","fix":"- Update to a Linux kernel release or distribution kernel package that includes the upstream thunderbolt fix for CVE-2026-98694; exact fixed versions are unknown from the sources.\n- Follow your distribution's security advisory for the patched kernel package.","status":"open","published_at":"2026-10-18T16:17:22+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:01+00:00","updated_at":"2026-10-25T05:19:01+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T05:19:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release or distribution kernel package that includes the upstream thunderbolt fix for CVE-2026-98694; exact fixed versions are unknown from the sources.\n- Follow your distribution's security advisory for the patched kernel package.","reach":"local","title":"Linux kernel Thunderbolt: use-after-free when a control request is canceled","impact":"medium","summary":"A race in the Linux kernel Thunderbolt control channel can let a canceled configuration request be queued again after its memory is freed, which KASAN reports as a use-after-free. The sources do not describe a confirmed attacker-controlled exploit path, so the practical impact is a kernel memory-safety bug reachable through Thunderbolt bandwidth handling.","category":"other","nicknames":[],"who_cares":["linux","kernel","thunderbolt","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory corruption during Thunderbolt control operations; code execution impact unknown","analyst_note":"Check the NVD entry and the upstream kernel stable commit for affected and fixed kernel versions, and whether the bug is reachable without local hardware access.","how_to_check":"- Run `uname -r` and compare against the kernel version that carries the upstream fix, which the sources do not list.\n- Check whether the `thunderbolt` module is loaded with `lsmod | grep thunderbolt`.\n- Confirm the fix commit in your distribution's kernel changelog, since the sources do not give fixed versions.","needs_analyst":true,"not_affected_if":["no-thunderbolt-hardware","module-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the Thunderbolt driver, which handles USB4 and Thunderbolt tunnels and bandwidth management, are in scope. Hosts without Thunderbolt ports or where the thunderbolt module is not loaded are unlikely to be exposed; the sources do not say more.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000876,"input_tokens":5125,"output_tokens":727,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':145C,163C,170C,176C,184C,191C,198C,204C,211C,219C,225C,229C,232C,237C,243C,252C,258C,264C,272C,279C,286C,292C,299C,307C,313C,317C,320C,325C,331C,338C,344C,351C,357C,361C,364C,369C,375C,386C,391C,397C,404C,411C,417C,425C,432C,439C,445C,452C,460C,466C,470C,473C,478C,484C '-2026':15A,18A '-98694':16A,19A '1760':248C '2/1760':158C '24':151C '926':336C 'access':565C 'actual':635C 'addr':153C 'alan':109C 'alloc':245C 'alreadi':544C,569C 'asm':242C,330C,374C,483C 'attack':67B 'attacker-control':66B 'avail':202C,290C,443C 'away':585C 'bandwidth':85B,190C,197C,203C,210C,217C,278C,285C,291C,298C,305C,431C,438C,444C,451C,458C 'bug':81B,133C 'cach':250C 'call':531C 'cancel':13A,39B,108C,396C,498C,507C,523C,580C,615C,620C 'cfg':142C,160C,167C,174C,255C,262C,341C,348C,394C,401C,408C,415C,505C,514C,521C,558C,588C,613C,625C 'channel':35B,125C 'clean':603C 'complet':517C 'configur':40B 'confirm':65B 'consum':189C,196C,277C,284C,430C,437C 'control':10A,34B,68B,124C 'count':552C 'creation':383C 'cve':14A,17A 'dequeu':627C 'describ':63B 'dp':216C,304C,457C 'drop':554C 'estim':209C,297C,450C 'exploit':69B 'ffff88811067f290':154C 'find':590C 'first':576C 'fix':98C,571C 'follow':92C 'fork':236C,241C,324C,329C,368C,373C,477C,482C 'free':7A,58B,104C,122C,139C 'freed':49B,333C 'generat':183C,271C,424C 'get':181C,269C,422C 'hand':584C 'handl':86B,215C,303C,456C 'happen':510C 'help':491C 'host':25B 'howev':541C 'impact':74B 'instead':596C 'kasan':51B,99C,117C,134C 'keep':129C 'kernel':2A,20B,32B,77B,90C 'kfree':337C 'kmalloc':249C 'kthread':231C,319C,363C,472C 'kworker/u40':157C 'last':379C,487C 'let':37B 'link':182C,270C,423C 'linux':1A,21B,31B,89C 'look':502C 'make':577C,623C 'memori':47B,79B,566C 'memory-safeti':78B 'might':509C 'noprof':251C 'notic':118C 'one':223C,311C,355C,464C 'oper':126C 'part':132C 'path':70B 'port':180C,268C,421C 'potenti':380C 'practic':73B 'process':222C,310C,354C,463C 'put':343C 'queu':43B 'queue':384C,388C,534C,549C,639C 'race':28B 'raw':169C,257C,410C 'reachabl':82B 'read':148C,168C,175C,256C,263C,409C,416C 'recalc':208C,296C,449C 'refer':551C 'relat':381C 'releas':570C,628C 'relev':131C 'reli':598C 'remov':545C,636C 'report':52B,100C,110C 'request':11A,41B,106C,143C,161C,218C,306C,342C,349C,395C,402C,459C,500C,506C,515C,522C,548C,559C,581C,589C,606C,614C,626C,630C 'resolv':96C 'ret':234C,239C,322C,327C,366C,371C,475C,480C 'right':518C 'run':539C,594C,622C 'safeti':80B 'schedul':532C,592C 'second':377C 'self':24B 'self-host':23B 'show':494C 'size':150C 'slab':136C 'slab-use-after-fre':135C 'sometim':116C 'sourc':60B 'stack':488C 'start':524C 'stress':114C 'strip':127C 'sure':578C 'sync':144C,162C,403C 'task':156C,247C,335C 'tb':141C,159C,166C,173C,179C,187C,194C,201C,207C,214C,254C,261C,267C,275C,282C,289C,295C,302C,340C,347C,393C,400C,407C,414C,420C,428C,435C,442C,448C,455C,504C,513C,520C,557C,587C,612C,624C 'test':115C 'thread':228C,316C,360C,469C 'thunderbolt':3A,26B,33B,84B,97C,147C,165C,172C,178C,186C,193C,200C,206C,213C,221C,260C,266C,274C,281C,288C,294C,301C,309C,346C,353C,399C,406C,413C,419C,427C,434C,441C,447C,454C,462C 'trace':489C 'trigger':561C 'tunnel':195C,283C,436C 'usb3':188C,276C,429C 'use':5A,56B,102C,120C,137C 'use-after-fre':4A,55B,101C,119C 'vulner':93C 'work':224C,312C,350C,356C,382C,385C,389C,465C,516C,533C,537C,560C,618C 'worker':227C,315C,359C,468C,601C 'x1897/0x5e20':220C,308C,461C 'x18f/0x4a0':339C 'x1a/0x30':244C,332C,376C,485C 'x1c1/0x2c0':192C,280C,433C 'x1d3/0x510':259C 'x1ee/0x550':253C 'x1f6/0x250':405C 'x240/0x250':146C,164C 'x258/0x420':185C,273C,426C 'x2a0/0x1bc0':212C,300C,453C 'x365/0x470':233C,321C,365C,474C 'x367/0x510':171C,412C 'x54d/0x710':238C,326C,370C,479C 'x575/0xd00':387C 'x5e6/0xf70':230C,318C,362C,471C 'x5f2/0xeb0':205C,293C,446C 'x675/0x1230':226C,314C,358C,467C 'x77/0x80':392C 'x82/0x120':352C 'xb7/0xe0':345C 'xc7/0x260':398C 'xec/0x240':177C,265C,418C 'xfd/0x910':199C,287C,440C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Thunderbolt driver, which handles USB4 and Thunderbolt tunnels and bandwidth management, are in scope. Hosts without Thunderbolt ports or where the thunderbolt module is not loaded are unlikely to be exposed; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98694","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98694","severity":null,"published_at":"2026-10-18T16:17:22+00:00","modified_at":"2026-10-21T13:21:37+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}