CVE-2026-97508 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Set tb->root_switch to NULL when domain is stopped
Similarly what we do with the firmware connection manager. This makes tb_xdp_handle_request() return error to the remote host. However, we need to make sure we keep the uuid alive so that we can reply until the whole domain is released.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The Thunderbolt subsystem in the Linux kernel contains a logic flaw related to resource management during domain termination sequences. Specifically, when a Thunderbolt domain is stopped or disconnected, the root switch pointer within the tb_domain structure was not being explicitly cleared. This oversight creates a state inconsistency where internal pointers may reference deallocated memory or stale hardware contexts if subsequent operations attempt to access them before proper cleanup routines have fully executed. The vulnerability arises from an incomplete teardown process that fails to nullify critical structural references, potentially leading to use-after-free conditions or undefined behavior during the final stages of domain release.
This issue directly impacts the Thunderbolt eXpress Data Path (XDP) handling mechanism. When a remote host attempts to send requests via tb_xdp_handle_request(), the function relies on valid internal state to process commands and communicate back to the peer device. Without clearing the root switch reference, the kernel might attempt to interact with hardware or memory structures that are no longer active or have been freed by other parts of the teardown sequence. This can result in error responses being incorrectly generated or, more severely, a kernel panic due to invalid memory access. The fix ensures that tb->root_switch is set to NULL upon domain stoppage, aligning the behavior with how firmware connection managers handle similar state transitions and ensuring robust error reporting to remote hosts while preserving necessary identifiers like UUIDs for final reply completion.
From a security perspective, this vulnerability falls under CWE-416: Use After Free, as it involves accessing memory or hardware resources after they have been logically removed from the active system context. It also relates to CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, given that domain teardown often occurs in response to physical disconnection events which can race with ongoing data path operations. In terms of MITRE ATT&CK mapping, this type of kernel-level memory corruption could potentially be leveraged for privilege escalation if an attacker can trigger the specific sequence of disconnect and subsequent access, although it primarily represents a stability issue rather than a direct exploitation vector in most standard configurations.
The operational impact includes potential system instability, including kernel panics or freezes, particularly when Thunderbolt devices are frequently connected and disconnected during active data transfer sessions. It may also lead to incorrect error codes being returned to user-space applications or remote peers, complicating debugging efforts for developers integrating with the Thunderbolt stack. To mitigate this risk, users should ensure their Linux kernels are updated to versions where this patch is included. System administrators can further reduce exposure by disabling unnecessary Thunderbolt ports in BIOS/UEFI settings if not required and avoiding hot-plugging of high-speed peripherals during critical system operations until patches are applied.