CVE-2026-89737 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: thunderbolt: Disable work before freeing tbt on remove
tbt_altmode_remove() drops the plug and cable references without draining tbt->work. The work function dereferences those references, and can also requeue itself in its error path. The VDM callbacks can queue the same work item.
Disable and drain tbt->work before dropping the references. This waits for an existing invocation and prevents subsequent schedule_work() calls from queueing it during teardown.
This issue was found by an in-house static analysis tool and confirmed by manual code review.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The identified vulnerability resides within the Linux kernel's USB Type-C Thunderbolt subsystem, specifically affecting the removal routine for alternate mode drivers. The core technical flaw is a race condition triggered during device teardown where resource deallocation occurs before concurrent asynchronous work items are properly terminated. In the tbt_altmode_remove function, the system proceeds to drop plug and cable references immediately without first ensuring that any pending or executing work functions associated with the Thunderbolt context have completed their execution. This sequence creates a window of vulnerability where the underlying data structures referenced by these objects may be freed while still being accessed by active kernel threads.
The operational impact stems from the behavior of the tbt->work function, which is scheduled to handle various asynchronous tasks related to Thunderbell communication and state management. Because this work item can dereference the very plug and cable references that are being released in the removal path, a premature deallocation leads to use-after-free conditions. Furthermore, the vulnerability is exacerbated by the fact that the work function has an error handling path capable of requeuing itself. This self-requeueing behavior means that even if one instance completes, another might be scheduled before the references are fully invalidated, increasing the likelihood of accessing freed memory. Additionally, Vendor Defined Message callbacks can independently queue this same work item, further complicating synchronization and ensuring multiple execution contexts may attempt to access resources simultaneously during teardown.
From a classification perspective, this issue aligns with CWE-416, Use After Free, as it involves referencing memory that has been deallocated. It also relates to CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, due to the race condition between the removal thread and the workqueue execution threads. In terms of attack vectors, this could potentially be leveraged for local privilege escalation or denial of service if an attacker can trigger device removal while Thunderbolt operations are in progress, although exploitation typically requires physical access or specific driver interaction capabilities. The vulnerability was initially detected through static analysis tools designed to identify unsafe memory access patterns and subsequently validated via manual code review, confirming the logical error in the teardown sequence.
To mitigate this risk, the implemented fix mandates disabling and draining the tbt->work queue before any references are dropped during device removal. This ensures that all currently executing instances of the work function complete their tasks safely before the associated memory structures become invalid. By preventing subsequent schedule_work calls from queuing new tasks during the teardown phase, the system maintains data integrity and prevents access to freed resources. System administrators should ensure they apply kernel updates containing this patch promptly to maintain stability in environments utilizing Thunderbolt devices with alternate mode support. Regular maintenance of kernel versions is critical as such low-level concurrency bugs can lead to unpredictable system crashes or security compromises if left unaddressed.