CVE-2026-97510: thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Release request if tbcfgrequest() fails in tbxdomainresponse()
If tbcfgrequest() fails setting up the request (for example the control channel is shut down already) it returns an error without calling the callback. To avoid leaking that memory, call tbcfgrequestput() if tbcfgrequest() fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel, ensure __tb_xdomain_response() calls tb_cfg_request_put() when tb_cfg_request() fails, to release the request and prevent memory leakage.
Event History
Frequently Asked Questions
What condition triggers the memory leak?
The leak occurs when tb_cfg_request() fails while __tb_xdomain_response() is setting up a request. One cited example is that the Thunderbolt control channel has already been shut down, causing the function to return without invoking its callback.
What is the practical impact described by the fix?
The issue is a request-memory leak: the request is not released when tb_cfg_request() returns an error. The fix explicitly calls tb_cfg_request_put() on that failure path.