CVE-2026-98691: thunderbolt: Tear down inactive DP tunnels when the domain is stopped
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Tear down inactive DP tunnels when the domain is stopped
tbstop() only tears down DMA tunnels so a DP tunnel that is still waiting for dprxwork to complete keeps that work queued while the routers are removed and the control channel is stopped. The work only stops once the DPRX timeout has passed and because it requeues itself until then the flushworkqueue() in tbdomainremove() won't wait for its final run. The callback then runs against a domain that is already torn down. A reference to that domain is kept so the completion waiting for that domain to disappear in unbind will block until the timeout is eventually reached.
Tear down DP tunnels that are not active yet as well which also cancels that work. Tunnels for displays that are already alive are untouched and keep working.
Affected Software
Event History
Frequently Asked Questions
What systems are realistically exposed to this issue?
Linux systems using Thunderbolt DisplayPort tunneling are affected when a DP tunnel is still inactive and waiting for DPRX work as the Thunderbolt domain is stopped or removed. Displays whose tunnels are already active are explicitly described as continuing to work.
What condition triggers the unsafe callback?
A DP tunnel must still be waiting for dprx_work when routers are removed and the control channel is stopped. The queued work can requeue until the DPRX timeout, then run after the associated domain has already been torn down.
What operational symptom can indicate the problem has occurred?
Unbinding can block while waiting for the Thunderbolt domain to disappear. The block lasts until the DPRX timeout is reached because the queued work retains a reference to the domain.
What does the fix change?
The fix tears down inactive DP tunnels when the domain is stopped, which cancels the outstanding DPRX work. It does not tear down tunnels for displays that are already active.