Linux Kernel up to 7.2.9/7.3-rc5 Thunderbolt tb_tunnel_alloc_dp memory leak

Summaryinfo

A vulnerability identified as problematic has been detected in Linux Kernel up to 7.2.9/7.3-rc5. This vulnerability affects the function tb_tunnel_alloc_dp of the component Thunderbolt. Performing a manipulation results in memory leak. This vulnerability is identified as CVE-2026-98692. The attack is only possible with local access. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Linux Kernel up to 7.2.9/7.3-rc5. This affects the function tb_tunnel_alloc_dp of the component Thunderbolt. The manipulation with an unknown input leads to a memory leak vulnerability. CWE is classifying the issue as CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. This is going to have an impact on integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Make the DP tunnel activation callback mandatory tb_tunnel_alloc_dp() takes an optional callback which is run from dprx_work once the DPRX capabilities read has completed. Without that callback tb_dp_dprx_start() reads the capabilities synchronously and never queues the work. It however always takes a tunnel reference which is only dropped by dprx_work itself or by tb_dp_dprx_stop() when cancel_delayed_work() actually canceled that work. That reference is thus leaked for every tunnel without a callback. The only tunnels without one are those from tb_tunnel_discover_dp(), which are activated again when restoring from hibernation. Pass the callback to tb_tunnel_discover_dp() as well and drop the synchronous path such that the DPRX capabilities are always read from dprx_work. Hibernation restore then also no longer blocks for up to 12 seconds while waiting for that read to complete. Also fix up the KUnit tests.

The advisory is shared at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-98692 since 09/25/2026. The exploitability is told to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 7.2.10 or 7.3-rc6 eliminates this vulnerability. Applying the patch 47d60ea801fc333a10c576691eca2e7840b02d3d/12f5d8b85a66a0ac08d082517d92ce136f8c0d42 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.2.8
• 7.2.9
• 7.3-rc1
• 7.3-rc2
• 7.3-rc3
• 7.3-rc4
• 7.3-rc5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion