AZL-110647: CVE-2026-98896 affecting package kernel 6.6.157.1-1

Q: What conditions are needed to trigger the issue?

A Thunderbolt hotplug event must be queued while the Thunderbolt domain is being removed. The described example is unloading the driver at the same time that a device router is plugged in.

Q: Who is most exposed to this race condition?

Systems that use Thunderbolt hotplug and may unload the associated driver while devices are being connected are exposed to the described condition. The risk arises because the queued hotplug work can run after the domain has been removed.

Q: What can be done if an update cannot be applied immediately?

Avoid unloading the Thunderbolt driver concurrently with plugging in a device router. This reduces the specific hotplug-versus-domain-removal race described in the advisory.

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Keep the domain reference while processing hotplug

We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tbhandlehotplug() to run. Avoid possible UAF in this case by taking the domain reference before scheduling the hotplug handler in tbqueuehotplug().

Affected Software

1 affected component

azure-linux/kernel<=6.6.157.1-1

Event History

Oct 23, 2026

Advisory Published

via OSV·12:18 PM

Data Sourced

via OSV·12:18 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-98896

Frequently Asked Questions

What conditions are needed to trigger the issue?

A Thunderbolt hotplug event must be queued while the Thunderbolt domain is being removed. The described example is unloading the driver at the same time that a device router is plugged in.

Who is most exposed to this race condition?

Systems that use Thunderbolt hotplug and may unload the associated driver while devices are being connected are exposed to the described condition. The risk arises because the queued hotplug work can run after the domain has been removed.

What can be done if an update cannot be applied immediately?

Avoid unloading the Thunderbolt driver concurrently with plugging in a device router. This reduces the specific hotplug-versus-domain-removal race described in the advisory.

AZL-110647: CVE-2026-98896 affecting package kernel 6.6.157.1-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are needed to trigger the issue?

Who is most exposed to this race condition?

What can be done if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

What conditions are needed to trigger the issue?

Who is most exposed to this race condition?

What can be done if an update cannot be applied immediately?