CVE-2026-97510
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()
If tb_cfg_request() fails setting up the request (for example the control channel is shut down already) it returns an error without calling the callback. To avoid leaking that memory, call tb_cfg_request_put() if tb_cfg_request() fails.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The Thunderbolt subsystem within the Linux kernel manages high-speed peripheral connections and interconnects devices using a complex protocol stack involving configuration requests and domain responses. A specific flaw was identified in the __tb_xdomain_response function, which handles response packets for cross-domain communication between Thunderbolt controllers or connected devices. This function initiates asynchronous configuration requests via tb_cfg_request to query device capabilities or status. Under normal operation, this request mechanism allocates memory structures that are managed through reference counting and callback mechanisms to ensure proper lifecycle management of the allocated resources.
The vulnerability arises when tb_cfg_request fails during its initialization phase, particularly in scenarios where the control channel has already been shut down or is otherwise unavailable. In such failure cases, the function returns an error code immediately without invoking the associated completion callback that would normally trigger resource cleanup routines. Because the memory allocation for the request structure occurs prior to this check, the absence of a corresponding release call results in a direct memory leak. Each occurrence of this condition leaves allocated kernel memory unreleased until system reboot or module unload, leading to gradual depletion of available kernel heap space over time if triggered repeatedly.
From a technical perspective, this represents an improper resource management error where cleanup logic is not executed on all code paths, specifically the failure path. This aligns with CWE-401, which describes missing release of memory after effective allocation. The issue does not currently allow for remote exploitation or privilege escalation since it requires physical access to trigger Thunderbolt device interactions and depends on specific timing conditions where the control channel is already down. However, sustained triggering could lead to denial of service through resource exhaustion, impacting system stability and performance as kernel memory becomes fragmented or depleted.
The operational impact includes potential system instability under heavy Thunderbolt usage patterns combined with connection drops or hardware faults that cause repeated configuration request failures. While not a critical security vulnerability in terms of direct compromise, it degrades system reliability over extended periods. The fix involves adding an explicit call to tb_cfg_request_put within the error handling block of __tb_xdomain_response, ensuring that allocated resources are properly released regardless of whether the initial setup succeeds or fails. This change enforces consistent resource lifecycle management across all execution paths in this subsystem component.
Mitigation strategies include applying the kernel patch provided by distribution maintainers to update the Thunderbolt driver code. Administrators should monitor system logs for repeated Thunderbolt-related errors which might indicate frequent triggering of this condition, potentially signaling hardware issues or misconfigured devices causing excessive failed requests. Regularly updating the Linux kernel ensures that such resource management fixes are incorporated into production environments. Additionally, implementing monitoring solutions that track kernel memory usage trends can help detect early signs of memory leaks before they impact system performance significantly.