HIGH Introduced in 4.15
thunderbolt RootSwitch UAF
CVE-2026-97508
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Set tb->root_switch to NULL when domain is stopped Similarly what we do with the firmware connection manager. This makes tb_xdp_handle_request() return error to the remote host. However, we need to make sure we keep the uuid alive so that we can reply until the whole domain is released.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability in the Linux Thunderbolt driver can be triggered when a domain is stopped while cross-domain requests from a connected peer are being processed concurrently. An attacker with physical access to a Thunderbolt port could exploit the race window to cause kernel memory corruption, potentially leading to information disclosure, privilege escalation, or a system crash.
Vulnerability analysis
When a Thunderbolt domain is shut down, the driver frees an internal switch object but leaves a reference to it in place. A concurrently running request from a connected peer can then access that freed object through the stale reference. The fix clears the reference as soon as the object is removed so incoming requests see the domain as stopped, duplicates the data needed to reply to peers while it is still safe to access, and guards the downstream path that walks switch ports. A malicious device plugged into a Thunderbolt port can send requests during the shutdown window to trigger the race.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.15 | 5.10.271 | d9a638e7bc87 |
| 5.15 | 4.15 | 5.15.222 | 66b0fe27e277 |
| 6.1 | 4.15 | 6.1.189 | 54ad3415cc21 |
| 6.6 | 4.15 | 6.6.158 | 83d1af5b1b6e |
| 6.12 | 4.15 | 6.12.111 | f06e9fbae78a |
| 6.18 | 4.15 | 6.18.53 | 99f019d2e9eb |
| mainline | 4.15 | 7.2 | e56249d8a68e |
| cip/6.12 | 4.15 | 6.12.111-cip32 | f06e9fbae78a |