Strix
73.2K

CVE-2026-98896

UnknownEPSS 0.19%

Last modified

CVE-2026-98896 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tb_domain_remove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tb_handle_hotplug() to run. EPSS estimates a 0.19% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tb_domain_remove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by taking the domain reference before scheduling the hotplug handler in tb_queue_hotplug().

Metrics

EPSS Probability
0.19%

8.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= d6cc51cd1a4aed1d9e2dd66d643d729acb4be560, < 06b2e894e640f6a3dbeb536a2d26d72426b26a46; >= d6cc51cd1a4aed1d9e2dd66d643d729acb4be560, < 1d991f749a8255ee2ecc6307e2f27354ab631827; >= d6cc51cd1a4aed1d9e2dd66d643d729acb4be560, < e8656465d08ed832e120c9cca4a6d0c8ccb45698; >= d6cc51cd1a4aed1d9e2dd66d643d729acb4be560, < b61a4ae2ec6a0d363615d01106e0a2d284133a38; >= d6cc51cd1a4aed1d9e2dd66d643d729acb4be560, < 04df2985159e381c88a923fae1bec2f8d0272412; >= d6cc51cd1a4aed1d9e2dd66d643d729acb4be560, < 0a87af3b1e3aa2e09d160848daf0c39e765b73de; >= d6cc51cd1a4aed1d9e2dd66d643d729acb4be560, < 138ec65b2c761f065b19d115aed2b8246fc272f5
LinuxLinux3.17

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98896?
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tb_domain_remove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by taking the domain reference before scheduling the hotplug handler in tb_queue_hotplug().
How severe is CVE-2026-98896?
Severity scoring for CVE-2026-98896 is pending analysis. The EPSS model estimates a 0.19% probability of exploitation in the next 30 days.
How do I fix CVE-2026-98896?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98896?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST