CVE-2026-98689

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Don't access a DP tunnel after its DPRX read was canceled

tb_dp_dprx_work() checks ->dprx_canceled before it takes tb->lock so it

misses a tb_dp_dprx_stop() that could not cancel the already running

work. It then polls the DPRX capabilities and runs the callback for a

tunnel that has already been torn down while the domain is suspending or

going away.

This can be hit by cancelling the DPRX read from outside the ordered

tb->wq: During suspend tb_disconnect_and_release_dp() does just this and

with a later patch tb_stop() will do it as well. The latter in combination

with the Apple NHI where the DPRX read never completed is how I hit

this.

Check the flag with tb->lock held instead and check it again in

tb_dp_tunnel_active() because the callback runs after the lock has been

dropped again.

Also clear the flag in tb_dp_dprx_start() so that it only ever describes

the work that is currently in flight.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References