CVE-2026-97509
Description
A flaw was found in the Linux kernel's Thunderbolt subsystem. A local attacker could exploit this issue to cause a Denial of Service (DoS) or potentially execute arbitrary code. The vulnerability occurs because the driver fails to maintain a reference to the parent domain device during the lifetime of an active service, allowing the parent structure to be deallocated prematurely. When the service is later destroyed, accessing the released structure results in a use-after-free condition that crashes the system.
Statement
A low impact use-after-free flaw was found in the Linux kernel's Thunderbolt subsystem. The driver did not keep a reference to the parent XDomain device during the lifetime of an enumerated service, so if the XDomain was deallocated before the service was destroyed (for example when a Thunderbolt/USB4 device is disconnected), tb_service_release() accessed the already freed parent structure when releasing the service ID, resulting in a use-after-free that can crash the kernel (denial of service) and potentially allow arbitrary code execution. Red Hat Enterprise Linux 7 (including kernel-rt), 8, 9, and 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS content shipped with OpenShift Container Platform 4 and 5 are affected; Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that release.
Exploitation requires local access to a system with Thunderbolt hardware and depends on the timing of device removal, and the issue is not network reachable. Red Hat therefore rates the impact as low (Red Hat CVSS 5.5, Moderate), which differs significantly from the upstream CVEORG severity of 8.8 (Important). Fixes for the affected products are deferred given the low impact and the local, hardware-dependent access required to trigger the flaw; the residual risk is primarily a local denial of service (system crash), with code execution theoretically possible but not demonstrated.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 8.8 |
| Attack Vector | Local | N/A | Adjacent Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
