{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97508", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.151Z", "datePublished": "2026-09-24T16:04:58.740Z", "dateUpdated": "2026-09-28T05:30:43.590Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-28T05:30:43.590Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Set tb->root_switch to NULL when domain is stopped\n\nSimilarly what we do with the firmware connection manager. This makes\ntb_xdp_handle_request() return error to the remote host. However, we\nneed to make sure we keep the uuid alive so that we can reply until the\nwhole domain is released."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - XDomain discovery packets (TB_CFG_PKG_XDOMAIN_REQ) from a connected Thunderbolt/USB4 peer enter via tb_ctl_rx_callback \u2192 tb_domain_event_cb \u2192 tb_xdomain_handle_request \u2192 tb_xdp_schedule_request and are handled in tb_xdp_handle_request, which then reads tb->root_switch after software-CM tb_stop(). This is a local Thunderbolt fabric, not a routable IP protocol.\nAC:H - The UAF requires software-CM tb_stop() to have already run tb_switch_remove(tb->root_switch) without clearing the pointer. tb_stop() is only called from tb_domain_remove() in nhi_pci_remove (NHI unbind/PCI removal), which a Thunderbolt peer cannot induce; UUID_REQUEST and other XDomain messages only queue system_wq work that then races that teardown.\nPR:N - tb_domain_event_cb dispatches TB_CFG_PKG_XDOMAIN_REQ to tb_xdomain_handle_request whenever tb_is_xdomain_enabled() (default-on xdomain module param plus ACPI OSC), with no device authorization or local credentials; UUID_REQUEST is answered even when tb_xdomain_find_by_route_locked() finds no xdomain.\nUI:N - Once a Thunderbolt/USB4 link exists, the peer injects XDomain control packets itself and tb_xdp_handle_request runs with no mount, sysfs write, or authorization dialog. Domain teardown is an attacker-independent condition and is scored as AC:H rather than a required victim UI step.\nS:U - The dangling tb->root_switch and sw->uuid accesses corrupt host kernel heap state inside the Thunderbolt driver; this does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After tb_stop() frees the host switch, tb_xdp_handle_request still holds tb->root_switch->uuid and tb_xdp_uuid_response() uuid_copy()s those 16 bytes into a UUID_RESPONSE sent back to the peer; UAF of struct tb_switch is also a kernel disclosure primitive.\nI:H - tb_xdomain_find_by_route() calls switch_find_xdomain(tb->root_switch) which walks the freed host switch via tb_switch_for_each_port, and later request handlers may operate on a reallocated tb_xdomain; that slab UAF can be sprayed into an arbitrary write or control-flow hijack.\nA:H - Dereferencing the freed root switch in tb_xdp_handle_request (uuid load) or switch_find_xdomain (port walk) oopses the system_wq kworker, crashing the host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/thunderbolt/tb.c", "drivers/thunderbolt/xdomain.c"], "versions": [{"version": "d1ff70241a275133e1a0258b7c23588b122276c8", "lessThan": "f06e9fbae78a51832211b4495a19412c7d49ecb4", "status": "affected", "versionType": "git"}, {"version": "d1ff70241a275133e1a0258b7c23588b122276c8", "lessThan": "99f019d2e9eb79adc485fef8aa8ada2cd0c843e9", "status": "affected", "versionType": "git"}, {"version": "d1ff70241a275133e1a0258b7c23588b122276c8", "lessThan": "e56249d8a68e712f3b60e1f3fdbb5b4fea146468", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/thunderbolt/tb.c", "drivers/thunderbolt/xdomain.c"], "versions": [{"version": "4.15", "status": "affected"}, {"version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f06e9fbae78a51832211b4495a19412c7d49ecb4"}, {"url": "https://git.kernel.org/stable/c/99f019d2e9eb79adc485fef8aa8ada2cd0c843e9"}, {"url": "https://git.kernel.org/stable/c/e56249d8a68e712f3b60e1f3fdbb5b4fea146468"}], "title": "thunderbolt: Set tb->root_switch to NULL when domain is stopped", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/thunderbolt/tb.c", "drivers/thunderbolt/xdomain.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f06e9fbae78a51832211b4495a19412c7d49ecb4", "status": "affected", "version": "d1ff70241a275133e1a0258b7c23588b122276c8", "versionType": "git"}, {"lessThan": "99f019d2e9eb79adc485fef8aa8ada2cd0c843e9", "status": "affected", "version": "d1ff70241a275133e1a0258b7c23588b122276c8", "versionType": "git"}, {"lessThan": "e56249d8a68e712f3b60e1f3fdbb5b4fea146468", "status": "affected", "version": "d1ff70241a275133e1a0258b7c23588b122276c8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/thunderbolt/tb.c", "drivers/thunderbolt/xdomain.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.15"}, {"lessThan": "4.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Set tb->root_switch to NULL when domain is stopped\n\nSimilarly what we do with the firmware connection manager. This makes\ntb_xdp_handle_request() return error to the remote host. However, we\nneed to make sure we keep the uuid alive so that we can reply until the\nwhole domain is released."}], "id": "CVE-2026-97508", "lastModified": "2026-09-28T06:16:36.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-24T17:17:28.650", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/99f019d2e9eb79adc485fef8aa8ada2cd0c843e9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e56249d8a68e712f3b60e1f3fdbb5b4fea146468"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f06e9fbae78a51832211b4495a19412c7d49ecb4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: thunderbolt: Set tb->root_switch to NULL when domain is stopped", "id": "2540545", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540545"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nthunderbolt: Set tb->root_switch to NULL when domain is stopped\nSimilarly what we do with the firmware connection manager. This makes\ntb_xdp_handle_request() return error to the remote host. However, we\nneed to make sure we keep the uuid alive so that we can reply until the\nwhole domain is released.", "A flaw was found in the Linux kernel's Thunderbolt subsystem. When a Thunderbolt domain is stopped, the driver fails to properly clear the root switch reference while handling active cross-domain requests. A connected host sending communication requests during domain shutdown can trigger an invalid memory access, potentially causing a system crash and resulting in a denial of service (DoS)."], "name": "CVE-2026-97508", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97508\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97508\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97508.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f06e9fbae78a51832211b4495a19412c7d49ecb4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,99f019d2e9eb79adc485fef8aa8ada2cd0c843e9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e56249d8a68e712f3b60e1f3fdbb5b4fea146468)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T01:15:20.465601+00:00", "updated": "2026-09-26T00:30:19.201796+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}