CVE-2026-98896 - Vulnerability Details

- thunderbolt: Keep the domain reference while processing hotplug

Description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Keep the domain reference while processing hotplug

We process hotplug events in a workqueue that may run after the domain
has been removed by tb_domain_remove(). For example if user unloads the
driver while at the same time plugging a device router we may have
scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by
taking the domain reference before scheduling the hotplug handler in
tb_queue_hotplug().

Published: 2026-10-23

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d6cc51cd1a4aed1d9e2dd66d643d729acb4be560`	affected	< 06b2e894e640f6a3dbeb536a2d26d72426b26a46
`d6cc51cd1a4aed1d9e2dd66d643d729acb4be560`	affected	< 1d991f749a8255ee2ecc6307e2f27354ab631827
`d6cc51cd1a4aed1d9e2dd66d643d729acb4be560`	affected	< e8656465d08ed832e120c9cca4a6d0c8ccb45698
`d6cc51cd1a4aed1d9e2dd66d643d729acb4be560`	affected	< b61a4ae2ec6a0d363615d01106e0a2d284133a38
`d6cc51cd1a4aed1d9e2dd66d643d729acb4be560`	affected	< 04df2985159e381c88a923fae1bec2f8d0272412
`d6cc51cd1a4aed1d9e2dd66d643d729acb4be560`	affected	< 0a87af3b1e3aa2e09d160848daf0c39e765b73de
`d6cc51cd1a4aed1d9e2dd66d643d729acb4be560`	affected	< 138ec65b2c761f065b19d115aed2b8246fc272f5

Linux

affected

Version	Status	Constraints
`3.17`	affected	—
`0`	unaffected	< 3.17
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,06b2e894e640f6a3dbeb536a2d26d72426b26a46)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1d991f749a8255ee2ecc6307e2f27354ab631827)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e8656465d08ed832e120c9cca4a6d0c8ccb45698)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b61a4ae2ec6a0d363615d01106e0a2d284133a38)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,04df2985159e381c88a923fae1bec2f8d0272412)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0a87af3b1e3aa2e09d160848daf0c39e765b73de)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,138ec65b2c761f065b19d115aed2b8246fc272f5)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,06b2e894e640f6a3dbeb536a2d26d72426b26a46)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1d991f749a8255ee2ecc6307e2f27354ab631827)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e8656465d08ed832e120c9cca4a6d0c8ccb45698)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b61a4ae2ec6a0d363615d01106e0a2d284133a38)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,04df2985159e381c88a923fae1bec2f8d0272412)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0a87af3b1e3aa2e09d160848daf0c39e765b73de)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,138ec65b2c761f065b19d115aed2b8246fc272f5)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00187.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98896.mbox
https://git.kernel.org/stable/c/04df2985159e381c88a923fae1bec2f8d0272412
https://git.kernel.org/stable/c/06b2e894e640f6a3dbeb536a2d26d72426b26a46
https://git.kernel.org/stable/c/0a87af3b1e3aa2e09d160848daf0c39e765b73de
https://git.kernel.org/stable/c/138ec65b2c761f065b19d115aed2b8246fc272f5
https://git.kernel.org/stable/c/1d991f749a8255ee2ecc6307e2f27354ab631827
https://git.kernel.org/stable/c/b61a4ae2ec6a0d363615d01106e0a2d284133a38
https://git.kernel.org/stable/c/e8656465d08ed832e120c9cca4a6d0c8ccb45698
https://nvd.nist.gov/vuln/detail/CVE-2026-98896
https://www.cve.org/CVERecord?id=CVE-2026-98896

History

Tue, 27 Oct 2026 05:30:00 +0100

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98896.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98896 https://www.cve.org/CVERecord?id=CVE-2026-98896
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 20:00:00 +0200

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 23 Oct 2026 17:30:00 +0200

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 14:00:00 +0200

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tb_domain_remove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by taking the domain reference before scheduling the hotplug handler in tb_queue_hotplug().
Title		thunderbolt: Keep the domain reference while processing hotplug
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/04df2985159e381c88a923fae1bec2f8d0272412 https://git.kernel.org/stable/c/06b2e894e640f6a3dbeb536a2d26d72426b26a46 https://git.kernel.org/stable/c/0a87af3b1e3aa2e09d160848daf0c39e765b73de https://git.kernel.org/stable/c/138ec65b2c761f065b19d115aed2b8246fc272f5 https://git.kernel.org/stable/c/1d991f749a8255ee2ecc6307e2f27354ab631827 https://git.kernel.org/stable/c/b61a4ae2ec6a0d363615d01106e0a2d284133a38 https://git.kernel.org/stable/c/e8656465d08ed832e120c9cca4a6d0c8ccb45698

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T11:37:58.225Z

Updated: 2026-10-26T06:56:22.985Z

Reserved: 2026-09-25T10:25:14.379Z

Link: CVE-2026-98896

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T12:18:23.547

Modified: 2026-10-26T07:17:14.857

Link: CVE-2026-98896

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-98896 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T19:45:17Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object