CVE-2026-97508
Description
A flaw was found in the Linux kernel's Thunderbolt subsystem. When a Thunderbolt domain is stopped, the driver fails to properly clear the root switch reference while handling active cross-domain requests. A connected host sending communication requests during domain shutdown can trigger an invalid memory access, potentially causing a system crash and resulting in a denial of service (DoS).
Statement
A flaw of moderate severity was found in the Linux kernel's Thunderbolt subsystem as shipped in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform (via RHEL CoreOS). When a Thunderbolt domain is stopped, the software connection manager fails to clear the root switch reference. A host connected over the Thunderbolt fabric that sends cross-domain (XDomain) requests while the local domain is being shut down can trigger an invalid memory access, causing a system crash and resulting in a denial of service. Exploitation requires a physical connection to the Thunderbolt domain and must win a race with the domain teardown, and the demonstrated impact is limited to availability. For these reasons Red Hat rates this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than the upstream rating of Important (CVSS 7.5), whose vector assumes high confidentiality and integrity impacts that the available evidence does not establish. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that stream. Fixes for the affected product streams are currently deferred in favor of higher-priority issues; the residual risk is a denial of service limited to the brief window of Thunderbolt domain shutdown by an attacker with access to the connected Thunderbolt fabric.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.5 |
| Attack Vector | Local | N/A | Adjacent Network |
| Attack Complexity | Low | N/A | High |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
