CVE-2026-80989

A flaw was found in the Linux kernel's Thunderbolt networking subsystem. When a Thunderbolt connection fails to establish, the system may not correctly update its state, leading to repeated attempts to tear down an already inactive connection. This can result in a kernel warning and, under certain configurations, a system crash (Denial of Service). Additionally, this flaw could lead to the premature release of resources still in use, potentially causing system instability.

Thunderbolt networking can leave login_sent set after tbnet_connected_work() fails while bringing a connection up. A later teardown can then repeat cleanup of state that was already unwound, stop rings that are already stopped, and trigger a dev_WARN that can become fatal when panic_on_warn is enabled. The HopID mismatch path can also release net remote_transmit_path even though this connection did not own that id, which may disrupt another active Thunderbolt networking path. For the CVSS the PR:N is used in the paranoid score because a malicious or faulty Thunderbolt peer does not need a local account on the victim once it can interact with the Thunderbolt networking link. The issue is adjacent reachable rather than Internet reachable. Impact is denial of service, with limited integrity risk from incorrect release of a path id owned by another connection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.