Hotplug Vulnerability in Linux Kernel Affects Device Management

CVE-2026-98896

What is CVE-2026-98896?

A vulnerability in the Linux kernel related to the Thunderbolt driver allows for a potential use after free (UAF) situation during hotplug events. Specifically, if a user unloads the driver while a device is being plugged in, the system may still attempt to handle this hotplug event using a reference that has already been removed. By ensuring the domain reference is held before scheduling the event handler, this vulnerability has been effectively addressed, thus enhancing system stability and security.

References