Look up another CVE · open CVE-2026-80989 in the interactive tracker
CVE-2026-80989
net: thunderbolt: Mark the connection down when bringing it up fails
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem drivers/net. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-80989 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Every failure path in tbnet_connected_work() undoes its own work and returns without clearing login_sent, so the connection still looks established. The next tbnet_tear_down() therefore takes its main branch and repeats a teardown that already happened: it stops rings that are already stopped, which is a dev_WARN() and fatal under panic_on_warn, and it releases net->remote_transmit_path even on the HopID mismatch path, where this connection never owned that id, silently freeing one that someone else is still using. Clear login_sent on those paths. That is enough for tbnet_tear_down() to leave the unwound state alone, and login_received has to stay set: it records that the peer has logged in and carries the transmit path it gave us, which nothing on this side can make the peer send again. Two things change beyond keeping the teardown out of the way: the logout request in that block is no longer sent, and the peer's next login request now re-queues our login work rather than connected_work, giving the connection a fresh login instead of a retry on stale state.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/net/thunderbolt/main.c
- What this is
- THUNDERBOLT NETWORK DRIVERMAINTAINERS section matched on drivers/net/thunderbolt/ · netdev@vger.kernel.org · Maintained
- Kernel module
- thunderbolt_net
Check it on the machine
grep -w CONFIG_USB4_NET /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w thunderbolt_netPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookworm?
- trixieMnot built on amd64/cloud-amd64, arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt/arm64, armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- forky, sidMnot built on amd64/cloud-amd64, arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt-arm64, armhf/armmp, armhf/armmp-lpae, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt/arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k
- ?
- not established - no Makefile entry for the affected file
- M
- a module where it is built at all; some flavours do not build it
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switch
- CONFIG_USB4_NET
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.34%, higher than 26.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.15 | 6.6.157 | e0d4a17afde5 |
| 4.15 | 6.12.109 | ed1d6e3d735e |
| 4.15 | 6.18.50 | f01e6a35c440 |
| 4.15 | 7.2.4 | d6c0af293129 |
| 4.15 | 7.3 | 3c8b26ebf525 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- Triggered by ThunderboltIP XDomain control messages (TBIP_LOGIN/TBIP_LOGOUT) from a peer on the same direct Thunderbolt/USB4 link; not Internet-routable, but reachable from an adjacent connected host, dock, or in-line device, matching other tbnet CVEs.
- AC:LAttack complexity, low
- A malicious peer completes the ThunderboltIP handshake, sends LOGIN with an invalid or colliding transmit_path so tbnet_connected_work() fails, then sends TBIP_LOGOUT to run tbnet_tear_down(); the attacker controls both sides with no race or layout dependency.
- PR:NPrivileges required, none
- No Linux account, capability, or init-namespace privilege is required; any Thunderbolt/USB4 peer that speaks ThunderboltIP can send the crafted login and logout on the unauthenticated XDomain control channel after the automatic host-to-host handshake.
- UI:NUser interaction, none
- Once a ThunderboltIP-capable link exists, which is typical for docks, direct laptop-to-laptop networking, and shared workstations, the peer can force the failed bring-up and teardown without further victim action beyond the existing cable connection.
- S:UScope, unchanged
- Impact stays in the host kernel Thunderbolt network driver and XDomain DMA path state (ring WARN, HopID IDA, NHI teardown) and does not by itself cross a VM, container, or IOMMU security boundary.
- C:HConfidentiality impact, high
- Failed bring-up leaves login_sent set, so the next teardown releases net->remote_transmit_path even when this connection never owned that HopID, freeing an ID another tunnel still uses; reuse of that HopID can misdirect NHI DMA and disclose kernel or other-tunnel buffer contents.
- I:HIntegrity impact, high
- The same stale-login teardown double-stops rings and disables or releases DMA HopIDs that may belong to another XDomain tunnel, and on ICM firmware it issues a port-wide XDomain disconnect, which can overwrite live hop config and let reused NHI DMA corrupt kernel memory.
- A:HAvailability impact, high
- Repeating teardown of an already unwound connection calls tb_ring_stop() on stopped rings (dev_WARN, fatal under panic_on_warn) and ida_free() of an unallocated or in-use HopID (WARN), and can hang or panic the host via bad DMA path teardown.