Linux Kernel Vulnerability in Thunderbolt Driver by Vendor

CVE-2026-89737

What is CVE-2026-89737?

A vulnerability exists in the Linux kernel's Thunderbolt driver where the function tbt_altmode_remove() fails to properly manage resources. Upon removing a Thunderbolt device, the function drops plug and cable references without ensuring the associated work queued by tbt->work is finished. This flaw may lead to race conditions, potentially resulting in dereferencing invalid references and unforeseen behavior. Proper handling requires disabling and draining the tbt->work before releasing the references, preventing erroneous calls that might queue additional work items during device teardown. This issue was identified through static analysis and confirmed with manual code reviews.

References