{"id":"CVE-2026-98694","aliases":[],"cve":{"records":[{"id":"CVE-2026-98694","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T10:25:14.364Z","published":"2026-10-18T15:46:18.654Z","modified":"2026-10-30T12:38:46.335Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-10-30T12:38:46.335Z"}],"references":[{"url":"https://git.kernel.org/stable/c/94358146389d985b809898cc23b1030ff240a25d","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/9594550e95bcc362027b7ad5f0d5665110f8a7d8","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/0dc4296ac0910d3a43d9e105226ace463e475304","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/b70b9c41f240c42bf6e728034537c0fe60c16ef4","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/71b3c517e02af2c46ad58d4b3706b7c3cb24936d","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/f18faa3d3b810d60a3005ae1b1d1866faa67d343","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/08287212b622039212c972806f896f078dfd28e2","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/a02188ddc24b7872f0c5e0c5873f827318717803","tags":[],"source":"Linux"}],"weaknesses":[],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.12.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.18.56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"7.2.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"7.3"}]}]}]}],"prioritization":[]},"title":"thunderbolt: Fix KASAN reported use-after-free when request is canceled","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Fix KASAN reported use-after-free when request is canceled\n\nAlan reported that when doing stress testing sometimes KASAN notices\nuse-after-free during control channel operation (stripped down keeping\nthe relevant parts):\n\n BUG: KASAN: slab-use-after-free in tb_cfg_request_sync+0x240/0x250 [thunderbolt]\n Read of size 24 at addr ffff88811067f290 by task kworker/u40:2/1760\n  <TASK>\n  tb_cfg_request_sync+0x240/0x250 [thunderbolt]\n  tb_cfg_read_raw+0x367/0x510 [thunderbolt]\n  tb_cfg_read+0xec/0x240 [thunderbolt]\n  tb_port_get_link_generation+0x258/0x420 [thunderbolt]\n  tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt]\n  tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt]\n  tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt]\n  tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt]\n  tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n  </TASK>\n\n Allocated by task 1760:\n  __kmalloc_cache_noprof+0x1ee/0x550\n  tb_cfg_read_raw+0x1d3/0x510 [thunderbolt]\n  tb_cfg_read+0xec/0x240 [thunderbolt]\n  tb_port_get_link_generation+0x258/0x420 [thunderbolt]\n  tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt]\n  tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt]\n  tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt]\n  tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt]\n  tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n\n Freed by task 926:\n  kfree+0x18f/0x4a0\n  tb_cfg_request_put+0xb7/0xe0 [thunderbolt]\n  tb_cfg_request_work+0x82/0x120 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n\n Second to last potentially related work creation:\n  __queue_work+0x575/0xd00\n  queue_work_on+0x77/0x80\n  tb_cfg_request_cancel+0xc7/0x260 [thunderbolt]\n  tb_cfg_request_sync+0x1f6/0x250 [thunderbolt]\n  tb_cfg_read_raw+0x367/0x510 [thunderbolt]\n  tb_cfg_read+0xec/0x240 [thunderbolt]\n  tb_port_get_link_generation+0x258/0x420 [thunderbolt]\n  tb_usb3_consumed_bandwidth+0x1c1/0x2c0 [thunderbolt]\n  tb_tunnel_consumed_bandwidth+0xfd/0x910 [thunderbolt]\n  tb_available_bandwidth+0x5f2/0xeb0 [thunderbolt]\n  tb_recalc_estimated_bandwidth+0x2a0/0x1bc0 [thunderbolt]\n  tb_handle_dp_bandwidth_request+0x1897/0x5e20 [thunderbolt]\n  process_one_work+0x675/0x1230\n  worker_thread+0x5e6/0xf70\n  kthread+0x365/0x470\n  ret_from_fork+0x54d/0x710\n  ret_from_fork_asm+0x1a/0x30\n\nThe last stack trace is helpful because it shows that we are cancelling\na request and looking at tb_cfg_request_cancel() what might happen is\nthat tb_cfg_request_work() completes right before tb_cfg_request_cancel()\nstarts and because of this it will call schedule_work() queueing the\nsame work to run again. However, it is already removed from the\nrequest_queue and reference count is dropped so when\ntb_cfg_request_work() triggers again it will access memory that is\nalready released.\n\nFix this so that we first make sure a cancelled request is not handed\naway from tb_cfg_request_find() or scheduled to run. Then instead of\nrelying on the worker to clean up the request we will do it in\ntb_cfg_request_cancel() after the work is canceled from running. Make\ntb_cfg_request_dequeue() release the request only if it was actually\nremoved from the queue.","score":null,"severity":"unknown","published":"2026-10-18T15:46:18.654Z","modified":"2026-10-30T12:38:46.335Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1","status":"affected","lessThan":"94358146389d985b809898cc23b1030ff240a25d","versionType":"git"},{"version":"d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1","status":"affected","lessThan":"9594550e95bcc362027b7ad5f0d5665110f8a7d8","versionType":"git"},{"version":"d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1","status":"affected","lessThan":"0dc4296ac0910d3a43d9e105226ace463e475304","versionType":"git"},{"version":"d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1","status":"affected","lessThan":"b70b9c41f240c42bf6e728034537c0fe60c16ef4","versionType":"git"},{"version":"d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1","status":"affected","lessThan":"71b3c517e02af2c46ad58d4b3706b7c3cb24936d","versionType":"git"},{"version":"d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1","status":"affected","lessThan":"f18faa3d3b810d60a3005ae1b1d1866faa67d343","versionType":"git"},{"version":"d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1","status":"affected","lessThan":"08287212b622039212c972806f896f078dfd28e2","versionType":"git"},{"version":"d7f781bfdbf4eb7c5706c9974b8bf6d3c82e69c1","status":"affected","lessThan":"a02188ddc24b7872f0c5e0c5873f827318717803","versionType":"git"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98694"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"4.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.13","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.10","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98694"}],"remediation":[],"references":["https://git.kernel.org/stable/c/94358146389d985b809898cc23b1030ff240a25d","https://git.kernel.org/stable/c/9594550e95bcc362027b7ad5f0d5665110f8a7d8","https://git.kernel.org/stable/c/0dc4296ac0910d3a43d9e105226ace463e475304","https://git.kernel.org/stable/c/b70b9c41f240c42bf6e728034537c0fe60c16ef4","https://git.kernel.org/stable/c/71b3c517e02af2c46ad58d4b3706b7c3cb24936d","https://git.kernel.org/stable/c/f18faa3d3b810d60a3005ae1b1d1866faa67d343","https://git.kernel.org/stable/c/08287212b622039212c972806f896f078dfd28e2","https://git.kernel.org/stable/c/a02188ddc24b7872f0c5e0c5873f827318717803"],"sources":[{"name":"CVE","id":"CVE-2026-98694","modified":"2026-10-30T12:38:46.335Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-98694"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T14:02:20.038Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"The Linux kernel has a use-after-free vulnerability in the thunderbolt module, affecting versions prior to 5.10.273, 5.15.224, 6.1.191, 6.6.160, 6.12.113, 6.18.56, and 7.2.10. An attacker with access to the system may exploit this weakness, but the impact is unclear.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T14:56:05.743Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-98694"}]}}