CVE-2026-68372

A flaw was found in the Linux kernel's USB Type-C port handling. A local user, by unplugging a Thunderbolt dock, can trigger a race condition during the device teardown process. This can lead to a use-after-free vulnerability, where the system attempts to access memory that has already been released. Exploitation of this flaw could result in system instability, denial of service, or potentially lead to memory corruption.

This vulnerability is rated as having Moderate impact for Red Hat Enterprise Linux because exploitation requires physical access to detach Thunderbolt hardware or specific local conditions, limiting the impact primarily to a denial of service. Standard enterprise server deployments are generally unaffected in practice since hot-unplugging Type-C docking stations is primarily confined to mobile or desktop environments. While a race condition during device removal can cause kernel memory corruption or an unexpected system crash, remote exploitation is not possible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.