CVE-2026-89737

In the Linux kernel, the following vulnerability has been resolved: usb: typec: thunderbolt: Disable work before freeing tbt on remove tbt_altmode_remove() drops the plug and cable references without draining tbt->work. The work function dereferences those references, and can also requeue itself in its error path. The VDM callbacks can queue the same work item. Disable and drain tbt->work before dropping the references. This waits for an existing invocation and prevents subsequent schedule_work() calls from queueing it during teardown. This issue was found by an in-house static analysis tool and confirmed by manual code review.

• https://git.kernel.org/stable/c/0a25484fe22f621e151367a59a82330a22ac80bc
• https://git.kernel.org/stable/c/92090f6ff2acc81e9dd99881dcfb4f8c1bdaabd3
• https://git.kernel.org/stable/c/ebb840d982a612261cfc8a7687735a140c6c7024

Published

Sep 11, 2026

Last Modified

Sep 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89731In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-89732In the Linux kernel, the following vulnerability has been re…
• CVE-2026-89733In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-89734In the Linux kernel, the following vulnerability has been re…
• CVE-2026-89735In the Linux kernel, the following vulnerability has been re…
• CVE-2026-89736In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-89738In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-89739In the Linux kernel, the following vulnerability has been re…
• CVE-2026-8974Memory safety bugs present in Firefox ESR 140.10 and Firefox…8.8
• CVE-2026-89740In the Linux kernel, the following vulnerability has been re…
• CVE-2026-89741In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-89742In the Linux kernel, the following vulnerability has been re…7.8