CVE-2026-97509

A flaw was found in the Linux kernel's Thunderbolt subsystem. A local attacker could exploit this issue to cause a Denial of Service (DoS) or potentially execute arbitrary code. The vulnerability occurs because the driver fails to maintain a reference to the parent domain device during the lifetime of an active service, allowing the parent structure to be deallocated prematurely. When the service is later destroyed, accessing the released structure results in a use-after-free condition that crashes the system.

A low impact use-after-free flaw was found in the Linux kernel's Thunderbolt subsystem. The driver did not keep a reference to the parent XDomain device during the lifetime of an enumerated service, so if the XDomain was deallocated before the service was destroyed (for example when a Thunderbolt/USB4 device is disconnected), tb_service_release() accessed the already freed parent structure when releasing the service ID, resulting in a use-after-free that can crash the kernel (denial of service) and potentially allow arbitrary code execution. Red Hat Enterprise Linux 7 (including kernel-rt), 8, 9, and 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS content shipped with OpenShift Container Platform 4 and 5 are affected; Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that release.

Exploitation requires local access to a system with Thunderbolt hardware and depends on the timing of device removal, and the issue is not network reachable. Red Hat therefore rates the impact as low (Red Hat CVSS 5.5, Moderate), which differs significantly from the upstream CVEORG severity of 8.8 (Important). Fixes for the affected products are deferred given the low impact and the local, hardware-dependent access required to trigger the flaw; the residual risk is primarily a local denial of service (system crash), with code execution theoretically possible but not demonstrated.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.