UBUNTU-CVE-2026-98694: Use After Free
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation (stripped down keeping the relevant parts): BUG: KASAN: slab-use-after-free in tbcfgrequestsync+0x240/0x250 [thunderbolt] Read of size 24 at addr ffff88811067f290 by task kworker/u40:2/1760 <TASK> tbcfgrequestsync+0x240/0x250 [thunderbolt] tbcfgreadraw+0x367/0x510 [thunderbolt] tbcfgread+0xec/0x240 [thunderbolt] tbportgetlinkgeneration+0x258/0x420 [thunderbolt] tbusb3consumedbandwidth+0x1c1/0x2c0 [thunderbolt] tbtunnelconsumedbandwidth+0xfd/0x910 [thunderbolt] tbavailablebandwidth+0x5f2/0xeb0 [thunderbolt] tbrecalcestimatedbandwidth+0x2a0/0x1bc0 [thunderbolt] tbhandledpbandwidthrequest+0x1897/0x5e20 [thunderbolt] processonework+0x675/0x1230 workerthread+0x5e6/0xf70 kthread+0x365/0x470 retfromfork+0x54d/0x710 retfromforkasm+0x1a/0x30 </TASK> Allocated by task 1760: kmalloccachenoprof+0x1ee/0x550 tbcfgreadraw+0x1d3/0x510 [thunderbolt] tbcfgread+0xec/0x240 [thunderbolt] tbportgetlinkgeneration+0x258/0x420 [thunderbolt] tbusb3consumedbandwidth+0x1c1/0x2c0 [thunderbolt] tbtunnelconsumedbandwidth+0xfd/0x910 [thunderbolt] tbavailablebandwidth+0x5f2/0xeb0 [thunderbolt] tbrecalcestimatedbandwidth+0x2a0/0x1bc0 [thunderbolt] tbhandledpbandwidthrequest+0x1897/0x5e20 [thunderbolt] processonework+0x675/0x1230 workerthread+0x5e6/0xf70 kthread+0x365/0x470 retfromfork+0x54d/0x710 retfromforkasm+0x1a/0x30 Freed by task 926: kfree+0x18f/0x4a0 tbcfgrequestput+0xb7/0xe0 [thunderbolt] tbcfgrequestwork+0x82/0x120 [thunderbolt] processonework+0x675/0x1230 workerthread+0x5e6/0xf70 kthread+0x365/0x470 retfromfork+0x54d/0x710 retfromforkasm+0x1a/0x30 Second to last potentially related work creation: queuework+0x575/0xd00 queueworkon+0x77/0x80 tbcfgrequestcancel+0xc7/0x260 [thunderbolt] tbcfgrequestsync+0x1f6/0x250 [thunderbolt] tbcfgreadraw+0x367/0x510 [thunderbolt] tbcfgread+0xec/0x240 [thunderbolt] tbportgetlinkgeneration+0x258/0x420 [thunderbolt] tbusb3consumedbandwidth+0x1c1/0x2c0 [thunderbolt] tbtunnelconsumedbandwidth+0xfd/0x910 [thunderbolt] tbavailablebandwidth+0x5f2/0xeb0 [thunderbolt] tbrecalcestimatedbandwidth+0x2a0/0x1bc0 [thunderbolt] tbhandledpbandwidthrequest+0x1897/0x5e20 [thunderbolt] processonework+0x675/0x1230 workerthread+0x5e6/0xf70 kthread+0x365/0x470 retfromfork+0x54d/0x710 retfromforkasm+0x1a/0x30 The last stack trace is helpful because it shows that we are cancelling a request and looking at tbcfgrequestcancel() what might happen is that tbcfgrequestwork() completes right before tbcfgrequestcancel() starts and because of this it will call schedulework() queueing the same work to run again. However, it is already removed from the requestqueue and reference count is dropped so when tbcfgrequestwork() triggers again it will access memory that is already released. Fix this so that we first make sure a cancelled request is not handed away from tbcfgrequestfind() or scheduled to run. Then instead of relying on the worker to clean up the request we will do it in tbcfgrequestcancel() after the work is canceled from running. Make tbcfgrequestdequeue() release the request only if it was actually removed from the queue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1069.74~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1073.82~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1071.78~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1073.81~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1069.70~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-149.149.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1067.71~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-149.149~22.04.2 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1064.65~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-149.149 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1069.74 - Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1073.82 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1019.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1073.81 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1068.77 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1053.57 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1069.70 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-149.149.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1067.70 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1067.71 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1068.72 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1~24.04.2 - Upgrade
Upgrade
ubuntu/linux-vmwareto a version that resolves this vulnerability.Fixed in 6.8.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1036.41 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2056.58 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1064.65 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1069.74+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1073.82+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1073.81+fips1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-43.43 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1020.21 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1019.19 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1017.19 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1010.11 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1 - Compensating control
In the thunderbolt control-channel request handling, ensure a canceled request is not handed off from tb_cfg_request_find() or scheduled to run again: make tb_cfg_request_dequeue() release the request only when it actually removed it from the request queue, and have tb_cfg_request_cancel() clean up the request after canceling its work.
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
Systems using the Linux kernel Thunderbolt subsystem are the relevant exposure group. The reported use-after-free occurred during Thunderbolt control-channel operations while handling DisplayPort bandwidth requests under stress testing.
What conditions are associated with triggering the flaw?
The report associates the issue with cancellation of a Thunderbolt configuration request while another control-channel operation still accesses the request. No remote attacker, authentication, or user-interaction requirement is stated in the provided data.
Which Ubuntu kernel packages are listed as affected?
The listed packages are linux, linux-azure, linux-azure-fips, linux-aws-fips, linux-fips, linux-gcp, linux-gcp-fips, and linux-oracle.