Look up another CVE · open CVE-2026-97508 in the interactive tracker
CVE-2026-97508
thunderbolt: Set tb->root_switch to NULL when domain is stopped
Published 2026-09-24 (24 days ago) by the Linux kernel CNA. Subsystem drivers/thunderbolt. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-97508 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Similarly what we do with the firmware connection manager. This makes tb_xdp_handle_request() return error to the remote host. However, we need to make sure we keep the uuid alive so that we can reply until the whole domain is released.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/thunderbolt/tb.c
drivers/thunderbolt/xdomain.c
- What this is
- THUNDERBOLT DRIVERMAINTAINERS section matched on drivers/thunderbolt/ · linux-usb@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid, bookworm · linux-6.12?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-09-24 (24 days ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.22%, higher than 12.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/thunderbolt
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.15 | 5.10.271 | d9a638e7bc87 |
| 4.15 | 5.15.222 | 66b0fe27e277 |
| 4.15 | 6.1.189 | 54ad3415cc21 |
| 4.15 | 6.6.158 | 83d1af5b1b6e |
| 4.15 | 6.12.111 | f06e9fbae78a |
| 4.15 | 6.18.53 | 99f019d2e9eb |
| 4.15 | 7.2 | e56249d8a68e |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- XDomain discovery packets (TB_CFG_PKG_XDOMAIN_REQ) from a connected Thunderbolt/USB4 peer enter via tb_ctl_rx_callback → tb_domain_event_cb → tb_xdomain_handle_request → tb_xdp_schedule_request and are handled in tb_xdp_handle_request, which then reads tb->root_switch after software-CM tb_stop(). This is a local Thunderbolt fabric, not a routable IP protocol.
- AC:HAttack complexity, high
- The UAF requires software-CM tb_stop() to have already run tb_switch_remove(tb->root_switch) without clearing the pointer. tb_stop() is only called from tb_domain_remove() in nhi_pci_remove (NHI unbind/PCI removal), which a Thunderbolt peer cannot induce; UUID_REQUEST and other XDomain messages only queue system_wq work that then races that teardown.
- PR:NPrivileges required, none
- tb_domain_event_cb dispatches TB_CFG_PKG_XDOMAIN_REQ to tb_xdomain_handle_request whenever tb_is_xdomain_enabled() (default-on xdomain module param plus ACPI OSC), with no device authorization or local credentials; UUID_REQUEST is answered even when tb_xdomain_find_by_route_locked() finds no xdomain.
- UI:NUser interaction, none
- Once a Thunderbolt/USB4 link exists, the peer injects XDomain control packets itself and tb_xdp_handle_request runs with no mount, sysfs write, or authorization dialog. Domain teardown is an attacker-independent condition and is scored as AC:H rather than a required victim UI step.
- S:UScope, unchanged
- The dangling tb->root_switch and sw->uuid accesses corrupt host kernel heap state inside the Thunderbolt driver; this does not cross a VM, IOMMU, or sandbox boundary.
- C:HConfidentiality impact, high
- After tb_stop() frees the host switch, tb_xdp_handle_request still holds tb->root_switch->uuid and tb_xdp_uuid_response() uuid_copy()s those 16 bytes into a UUID_RESPONSE sent back to the peer; UAF of struct tb_switch is also a kernel disclosure primitive.
- I:HIntegrity impact, high
- tb_xdomain_find_by_route() calls switch_find_xdomain(tb->root_switch) which walks the freed host switch via tb_switch_for_each_port, and later request handlers may operate on a reallocated tb_xdomain; that slab UAF can be sprayed into an arbitrary write or control-flow hijack.
- A:HAvailability impact, high
- Dereferencing the freed root switch in tb_xdp_handle_request (uuid load) or switch_find_xdomain (port walk) oopses the system_wq kworker, crashing the host.