CVE-2026-97508: thunderbolt: Set tb->root_switch to NULL when domain is stopped
Published Sep 24, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Set tb->rootswitch to NULL when domain is stopped
Similarly what we do with the firmware connection manager. This makes tbxdphandlerequest() return error to the remote host. However, we need to make sure we keep the uuid alive so that we can reply until the whole domain is released.
Affected Software
1 affected component
Linux Linux kernel
Event History
Sep 24, 2026
CVE Published
via MITRE·04:04 PM
Data Sourced
via MITRE·04:04 PM
Description
Data Sourced
via NVD·05:17 PM
Description
Frequently Asked Questions
1
When can this issue be triggered?
It is relevant while a Thunderbolt domain has been stopped and a remote host sends a request handled by tb_xdp_handle_request(). The fix makes that request path return an error after the domain is stopped.
2
Does stopping the domain immediately remove all state needed for responses?
No. The UUID is intentionally kept alive until the entire domain is released so that replies can still be sent during teardown.