CVE-2026-74691

A flaw was found in the Linux kernel's Thunderbolt networking driver. During the process of shutting down a Thunderbolt device, the system incorrectly deallocates resources before ensuring that all data has finished transferring through the Direct Memory Access (DMA) paths. This can cause the Thunderbolt controller to become unresponsive. Repeated occurrences of this issue may lead to a Denial of Service (DoS) for the Thunderbolt controller, requiring a power cycle to restore its operation.

This vulnerability is rated as Moderate impact because it requires local access or direct physical Thunderbolt device connections, resulting solely in a denial of service without compromising system confidentiality or integrity. In typical Red Hat Enterprise Linux deployments, Thunderbolt networking is rarely utilized, as enterprise environments seldom configure peer-to-peer network interfaces across Thunderbolt or USB4 cables. Furthermore, triggering the condition necessitates repeated interface teardowns or device disconnects on specific host controllers, limiting the blast radius to systems actively running this protocol.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.