CVE-2026-98896 thunderbolt: Keep the domain reference while processing hotplug

Not scored Published 23 Oct 2026 Updated 26 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-98896?

CVE-2026-98896 is a vulnerability in Linux, published on 23 Oct 2026.

Official description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Keep the domain reference while processing hotplug

We process hotplug events in a workqueue that may run after the domain has been removed by tb_domain_remove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by taking the domain reference before scheduling the hotplug handler in tb_queue_hotplug().

Which versions are affected by CVE-2026-98896?

How do I fix CVE-2026-98896?

Upgrade to a fixed version.

Is CVE-2026-98896 being exploited?

There is no known exploitation of CVE-2026-98896 in the wild and no public exploit code.

Sources

Also known as AZL-110647, BELL-CVE-2026-98896, DEBIAN-CVE-2026-98896, GHSA-vrr8-45r3-5hwq, UBUNTU-CVE-2026-98896.