CVE-2026-98896
NONE—CVSS v3
—CVSS v2
—
EPSS (exploit probability)
—CWE
Description
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Keep the domain reference while processing hotplug
We process hotplug events in a workqueue that may run after the domain
has been removed by tb_domain_remove(). For example if user unloads the
driver while at the same time plugging a device router we may have
scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by
taking the domain reference before scheduling the hotplug handler in
tb_queue_hotplug().
Affected routers (0)
No routers currently mapped to this CVE in our database.