CVE-2026-89737

A flaw was found in the Linux kernel's USB Type-C Thunderbolt driver. The tbt_altmode_remove() function fails to properly disable and drain work items before freeing associated plug and cable references. This oversight can lead to a use-after-free vulnerability, where the system attempts to access memory that has already been released. A local attacker could potentially exploit this to cause a system crash, leading to a denial of service, or possibly achieve arbitrary code execution.

A use-after-free candidate exists in the USB Type-C Thunderbolt alternate mode teardown path because tbt work can still run or be queued after plug and cable references are dropped. The work function dereferences those references and can also requeue itself on an error path, while VDM callbacks can queue the same work item during teardown. A malicious or controlled Thunderbolt capable Type-C device may be able to trigger the race through hotplug and VDM activity, causing a kernel crash or other memory safety impact. For the CVSS the PR:N is selected because the paranoid scenario does not require a local account on the victim when the attacker has physical access to the port or controls the attached device. The issue is not network reachable. Impact is at least denial of service via kernel crash, and in the paranoid case may include confidentiality and integrity impact because the patch context supports a UAF race rather than a pure DoS-only bug.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.