Executive brief
The Linux kernel's Thunderbolt 3 USB Type-C driver could access freed memory during device removal. When a Thunderbolt device is disconnected, the driver was releasing references before stopping background work that still needed them, potentially causing system instability or crashes. The fix ensures cleanup work is stopped before memory is freed.
Technical details
This is a use-after-free vulnerability in the Thunderbolt alternate mode driver (drivers/usb/typec/altmodes/thunderbolt.c). The tbt_altmode_remove() function was dropping plug and cable references without first draining the tbt->work queue; the work function dereferences those references and can requeue itself in error paths. Additionally, VDM callbacks can queue the same work item. The fix adds disable_work_sync() before reference cleanup, which both waits for any in-flight work invocation and prevents subsequent scheduling during teardown. The issue was discovered via static analysis and confirmed by manual code review. The patch applies to Linux kernel versions with the original Thunderbolt driver (from commit 100e25738659 onwards).
Affected products
- Linux Linux kernel versions with Thunderbolt driver (from 100e25738659 onwards)
Timeline
- 2026-09-11: disclosed: CVE-2026-89737 published
- 2026-08-02: patched: Fix committed upstream (commit 92090f6ff2acc81e9dd99881dcfb4f8c1bdaabd3)
- 2026-09-07: patched: Fix included in stable kernel release