UBUNTU-CVE-2026-98689: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tbdpdprxwork() checks ->dprxcanceled before it takes tb->lock so it misses a tbdpdprxstop() that could not cancel the already running work. It then polls the DPRX capabilities and runs the callback for a tunnel that has already been torn down while the domain is suspending or going away. This can be hit by cancelling the DPRX read from outside the ordered tb->wq: During suspend tbdisconnectandreleasedp() does just this and with a later patch tbstop() will do it as well. The latter in combination with the Apple NHI where the DPRX read never completed is how I hit this. Check the flag with tb->lock held instead and check it again in tbdptunnelactive() because the callback runs after the lock has been dropped again. Also clear the flag in tbdpdprxstart() so that it only ever describes the work that is currently in flight.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1019.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1~24.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-43.43 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1020.21 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1019.19 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1017.19 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1010.11 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1 - Compensating control
Update the Thunderbolt DPRX work handling so tb_dp_dprx_start() clears the cancellation flag before starting work; check the flag while holding tb->lock; and check it again in tb_dp_tunnel_active() after the callback reacquires execution with the lock dropped, preventing access to a torn-down DP tunnel after the DPRX read is canceled.
Event History
Frequently Asked Questions
Which systems are most likely to be exposed?
Systems using the affected Ubuntu kernel packages and Thunderbolt DisplayPort tunneling are the relevant exposure set. The described trigger involves DisplayPort receiver reads during suspend or domain teardown, including an Apple NHI scenario where the DPRX read does not complete.
What conditions are needed to trigger the issue?
A DPRX read must be canceled outside the ordered Thunderbolt workqueue while its work is already running. The race can occur during suspend when the DisplayPort tunnel is disconnected and released, or while the Thunderbolt domain is going away.
Does exploitation require remote access or user interaction?
The supplied vector identifies local access, low privileges, high attack complexity, and no user interaction. The description does not provide a specific attacker-controlled trigger beyond the Thunderbolt DPRX cancellation race.