CVE-2026-98694 (GCVE-0-2026-98694)

Vulnerability from cvelistv5 – Published: 2026-10-18 15:46 – Updated: 2026-10-30 12:38
VLAI
Title
thunderbolt: Fix KASAN reported use-after-free when request is canceled
Summary
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation (stripped down keeping the relevant parts): BUG: KASAN: slab-use-after-free in tb_cfg_request_sync+0x240/0x250 [thunderbolt] Read of size 24 at addr ffff88811067f290 by task kworker/u40:2/1760 <TASK> tb_cfg_request_sync+0x240/0x250 [thunderbolt] tb_cfg_read_raw+0x367/0x510 [thunderbolt] tb_cfg_read+0xec/0x240 [thunderbolt] tb_port_get_link_generation+0x258/0x420 [thunderbolt] tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt] tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt] tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt] tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt] tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt] process_one_work+0x675/0x1230 worker_thread+0x5e6/0xf70 kthread+0x365/0x470 ret_from_fork+0x54d/0x710 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1760: __kmalloc_cache_noprof+0x1ee/0x550 tb_cfg_read_raw+0x1d3/0x510 [thunderbolt] tb_cfg_read+0xec/0x240 [thunderbolt] tb_port_get_link_generation+0x258/0x420 [thunderbolt] tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt] tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt] tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt] tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt] tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt] process_one_work+0x675/0x1230 worker_thread+0x5e6/0xf70 kthread+0x365/0x470 ret_from_fork+0x54d/0x710 ret_from_fork_asm+0x1a/0x30 Freed by task 926: kfree+0x18f/0x4a0 tb_cfg_request_put+0xb7/0xe0 [thunderbolt] tb_cfg_request_work+0x82/0x120 [thunderbolt] process_one_work+0x675/0x1230 worker_thread+0x5e6/0xf70 kthread+0x365/0x470 ret_from_fork+0x54d/0x710 ret_from_fork_asm+0x1a/0x30 Second to last potentially related work creation: __queue_work+0x575/0xd00 queue_work_on+0x77/0x80 tb_cfg_request_cancel+0xc7/0x260 [thunderbolt] tb_cfg_request_sync+0x1f6/0x250 [thunderbolt] tb_cfg_read_raw+0x367/0x510 [thunderbolt] tb_cfg_read+0xec/0x240 [thunderbolt] tb_port_get_link_generation+0x258/0x420 [thunderbolt] tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt] tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt] tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt] tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt] tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt] process_one_work+0x675/0x1230 worker_thread+0x5e6/0xf70 kthread+0x365/0x470 ret_from_fork+0x54d/0x710 ret_from_fork_asm+0x1a/0x30 The last stack trace is helpful because it shows that we are cancelling a request and looking at tb_cfg_request_cancel() what might happen is that tb_cfg_request_work() completes right before tb_cfg_request_cancel() starts and because of this it will call schedule_work() queueing the same work to run again. However, it is already removed from the request_queue and reference count is dropped so when tb_cfg_request_work() triggers again it will access memory that is already released. Fix this so that we first make sure a cancelled request is not handed away from tb_cfg_request_find() or scheduled to run. Then instead of relying on the worker to clean up the request we will do it in tb_cfg_request_cancel() after the work is canceled from running. Make tb_cfg_request_dequeue() release the request only if it was actually removed from the queue.
Severity
No CVSS data available.
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6847 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1 , < 94358146389d985b809898cc23b1030ff240a25d (git)
Affected: d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1 , < 9594550e95bcc362027b7ad5f0d5665110f8a7d8 (git)
Affected: d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1 , < 0dc4296ac0910d3a43d9e105226ace463e475304 (git)
Affected: d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1 , < b70b9c41f240c42bf6e728034537c0fe60c16ef4 (git)
Affected: d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1 , < 71b3c517e02af2c46ad58d4b3706b7c3cb24936d (git)
Affected: d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1 , < f18faa3d3b810d60a3005ae1b1d1866faa67d343 (git)
Affected: d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1 , < 08287212b622039212c972806f896f078dfd28e2 (git)
Affected: d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1 , < a02188ddc24b7872f0c5e0c5873f827318717803 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.13
Unaffected: 0 , < 4.13 (semver)
Unaffected: 5.10.273 , ≤ 5.10.* (semver)
Unaffected: 5.15.224 , ≤ 5.15.* (semver)
Unaffected: 6.1.191 , ≤ 6.1.* (semver)
Unaffected: 6.6.160 , ≤ 6.6.* (semver)
Unaffected: 6.12.113 , ≤ 6.12.* (semver)
Unaffected: 6.18.56 , ≤ 6.18.* (semver)
Unaffected: 7.2.10 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/thunderbolt/ctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "94358146389d985b809898cc23b1030ff240a25d",
              "status": "affected",
              "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
              "versionType": "git"
            },
            {
              "lessThan": "9594550e95bcc362027b7ad5f0d5665110f8a7d8",
              "status": "affected",
              "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
              "versionType": "git"
            },
            {
              "lessThan": "0dc4296ac0910d3a43d9e105226ace463e475304",
              "status": "affected",
              "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
              "versionType": "git"
            },
            {
              "lessThan": "b70b9c41f240c42bf6e728034537c0fe60c16ef4",
              "status": "affected",
              "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
              "versionType": "git"
            },
            {
              "lessThan": "71b3c517e02af2c46ad58d4b3706b7c3cb24936d",
              "status": "affected",
              "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
              "versionType": "git"
            },
            {
              "lessThan": "f18faa3d3b810d60a3005ae1b1d1866faa67d343",
              "status": "affected",
              "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
              "versionType": "git"
            },
            {
              "lessThan": "08287212b622039212c972806f896f078dfd28e2",
              "status": "affected",
              "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
              "versionType": "git"
            },
            {
              "lessThan": "a02188ddc24b7872f0c5e0c5873f827318717803",
              "status": "affected",
              "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/thunderbolt/ctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.273",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.224",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.56",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.10",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Fix KASAN reported use-after-free when request is canceled\n\nAlan reported that when doing stress testing sometimes KASAN notices\nuse-after-free during control channel operation (stripped down keeping\nthe relevant parts):\n\n BUG: KASAN: slab-use-after-free in tb_cfg_request_sync+0x240/0x250 [thunderbolt]\n Read of size 24 at addr ffff88811067f290 by task kworker/u40:2/1760\n  \u003cTASK\u003e\n  tb_cfg_request_sync+0x240/0x250 [thunderbolt]\n  tb_cfg_read_raw+0x367/0x510 [thunderbolt]\n  tb_cfg_read+0xec/0x240 [thunderbolt]\n  tb_port_get_link_generation+0x258/0x420 [thunderbolt]\n  tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt]\n  tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt]\n  tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt]\n  tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt]\n  tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n  \u003c/TASK\u003e\n\n Allocated by task 1760:\n  __kmalloc_cache_noprof+0x1ee/0x550\n  tb_cfg_read_raw+0x1d3/0x510 [thunderbolt]\n  tb_cfg_read+0xec/0x240 [thunderbolt]\n  tb_port_get_link_generation+0x258/0x420 [thunderbolt]\n  tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt]\n  tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt]\n  tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt]\n  tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt]\n  tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n\n Freed by task 926:\n  kfree+0x18f/0x4a0\n  tb_cfg_request_put+0xb7/0xe0 [thunderbolt]\n  tb_cfg_request_work+0x82/0x120 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n\n Second to last potentially related work creation:\n  __queue_work+0x575/0xd00\n  queue_work_on+0x77/0x80\n  tb_cfg_request_cancel+0xc7/0x260 [thunderbolt]\n  tb_cfg_request_sync+0x1f6/0x250 [thunderbolt]\n  tb_cfg_read_raw+0x367/0x510 [thunderbolt]\n  tb_cfg_read+0xec/0x240 [thunderbolt]\n  tb_port_get_link_generation+0x258/0x420 [thunderbolt]\n  tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt]\n  tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt]\n  tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt]\n  tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt]\n  tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n\nThe last stack trace is helpful because it shows that we are cancelling\na request and looking at tb_cfg_request_cancel() what might happen is\nthat tb_cfg_request_work() completes right before tb_cfg_request_cancel()\nstarts and because of this it will call schedule_work() queueing the\nsame work to run again. However, it is already removed from the\nrequest_queue and reference count is dropped so when\ntb_cfg_request_work() triggers again it will access memory that is\nalready released.\n\nFix this so that we first make sure a cancelled request is not handed\naway from tb_cfg_request_find() or scheduled to run. Then instead of\nrelying on the worker to clean up the request we will do it in\ntb_cfg_request_cancel() after the work is canceled from running. Make\ntb_cfg_request_dequeue() release the request only if it was actually\nremoved from the queue."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:38:46.335Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/94358146389d985b809898cc23b1030ff240a25d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9594550e95bcc362027b7ad5f0d5665110f8a7d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dc4296ac0910d3a43d9e105226ace463e475304"
        },
        {
          "url": "https://git.kernel.org/stable/c/b70b9c41f240c42bf6e728034537c0fe60c16ef4"
        },
        {
          "url": "https://git.kernel.org/stable/c/71b3c517e02af2c46ad58d4b3706b7c3cb24936d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f18faa3d3b810d60a3005ae1b1d1866faa67d343"
        },
        {
          "url": "https://git.kernel.org/stable/c/08287212b622039212c972806f896f078dfd28e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a02188ddc24b7872f0c5e0c5873f827318717803"
        }
      ],
      "title": "thunderbolt: Fix KASAN reported use-after-free when request is canceled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98694",
    "datePublished": "2026-10-18T15:46:18.654Z",
    "dateReserved": "2026-09-25T10:25:14.364Z",
    "dateUpdated": "2026-10-30T12:38:46.335Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98694",
      "date": "2026-11-03",
      "epss": "0.00176",
      "percentile": "0.072"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-28T01:47:53.000Z",
      "cve": "CVE-2026-98694",
      "id": "msrc_CVE-2026-98694",
      "initial_release_date": "2026-10-20T01:02:16.000Z",
      "product_status:known_not_affected": "1",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "thunderbolt: Fix KASAN reported use-after-free when request is canceled",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-98694.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/thunderbolt/ctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "94358146389d985b809898cc23b1030ff240a25d",
                    "status": "affected",
                    "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9594550e95bcc362027b7ad5f0d5665110f8a7d8",
                    "status": "affected",
                    "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0dc4296ac0910d3a43d9e105226ace463e475304",
                    "status": "affected",
                    "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b70b9c41f240c42bf6e728034537c0fe60c16ef4",
                    "status": "affected",
                    "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "71b3c517e02af2c46ad58d4b3706b7c3cb24936d",
                    "status": "affected",
                    "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f18faa3d3b810d60a3005ae1b1d1866faa67d343",
                    "status": "affected",
                    "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "08287212b622039212c972806f896f078dfd28e2",
                    "status": "affected",
                    "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a02188ddc24b7872f0c5e0c5873f827318717803",
                    "status": "affected",
                    "version": "d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/thunderbolt/ctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.13"
                  },
                  {
                    "lessThan": "4.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.273",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.224",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.191",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.160",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.56",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Fix KASAN reported use-after-free when request is canceled\n\nAlan reported that when doing stress testing sometimes KASAN notices\nuse-after-free during control channel operation (stripped down keeping\nthe relevant parts):\n\n BUG: KASAN: slab-use-after-free in tb_cfg_request_sync+0x240/0x250 [thunderbolt]\n Read of size 24 at addr ffff88811067f290 by task kworker/u40:2/1760\n  \u003cTASK\u003e\n  tb_cfg_request_sync+0x240/0x250 [thunderbolt]\n  tb_cfg_read_raw+0x367/0x510 [thunderbolt]\n  tb_cfg_read+0xec/0x240 [thunderbolt]\n  tb_port_get_link_generation+0x258/0x420 [thunderbolt]\n  tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt]\n  tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt]\n  tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt]\n  tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt]\n  tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n  \u003c/TASK\u003e\n\n Allocated by task 1760:\n  __kmalloc_cache_noprof+0x1ee/0x550\n  tb_cfg_read_raw+0x1d3/0x510 [thunderbolt]\n  tb_cfg_read+0xec/0x240 [thunderbolt]\n  tb_port_get_link_generation+0x258/0x420 [thunderbolt]\n  tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt]\n  tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt]\n  tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt]\n  tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt]\n  tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n\n Freed by task 926:\n  kfree+0x18f/0x4a0\n  tb_cfg_request_put+0xb7/0xe0 [thunderbolt]\n  tb_cfg_request_work+0x82/0x120 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n\n Second to last potentially related work creation:\n  __queue_work+0x575/0xd00\n  queue_work_on+0x77/0x80\n  tb_cfg_request_cancel+0xc7/0x260 [thunderbolt]\n  tb_cfg_request_sync+0x1f6/0x250 [thunderbolt]\n  tb_cfg_read_raw+0x367/0x510 [thunderbolt]\n  tb_cfg_read+0xec/0x240 [thunderbolt]\n  tb_port_get_link_generation+0x258/0x420 [thunderbolt]\n  tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt]\n  tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt]\n  tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt]\n  tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt]\n  tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n\nThe last stack trace is helpful because it shows that we are cancelling\na request and looking at tb_cfg_request_cancel() what might happen is\nthat tb_cfg_request_work() completes right before tb_cfg_request_cancel()\nstarts and because of this it will call schedule_work() queueing the\nsame work to run again. However, it is already removed from the\nrequest_queue and reference count is dropped so when\ntb_cfg_request_work() triggers again it will access memory that is\nalready released.\n\nFix this so that we first make sure a cancelled request is not handed\naway from tb_cfg_request_find() or scheduled to run. Then instead of\nrelying on the worker to clean up the request we will do it in\ntb_cfg_request_cancel() after the work is canceled from running. Make\ntb_cfg_request_dequeue() release the request only if it was actually\nremoved from the queue."
          }
        ],
        "id": "CVE-2026-98694",
        "lastModified": "2026-10-30T13:21:18.383",
        "metrics": {},
        "published": "2026-10-18T16:17:22.830",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/08287212b622039212c972806f896f078dfd28e2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0dc4296ac0910d3a43d9e105226ace463e475304"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/71b3c517e02af2c46ad58d4b3706b7c3cb24936d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/94358146389d985b809898cc23b1030ff240a25d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9594550e95bcc362027b7ad5f0d5665110f8a7d8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a02188ddc24b7872f0c5e0c5873f827318717803"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b70b9c41f240c42bf6e728034537c0fe60c16ef4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f18faa3d3b810d60a3005ae1b1d1866faa67d343"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-30T06:49:18+00:00",
      "cve": "CVE-2026-98694",
      "id": "CVE-2026-98694",
      "initial_release_date": "2026-10-18T00:00:00+00:00",
      "product_status:known_affected": "265",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: thunderbolt: Fix KASAN reported use-after-free when request is canceled",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98694.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-22T16:35:46Z",
      "cve": "CVE-2026-98694",
      "id": "CVE-2026-98694",
      "initial_release_date": "2026-10-18T23:43:38Z",
      "product_status:known_affected": "263",
      "product_status:known_not_affected": "85",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-98694",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-98694.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.