CVE-2026-98689

A flaw was found in the Linux kernel's Thunderbolt subsystem. A race condition occurs when DisplayPort (DP) read operations are canceled during system suspend or device disconnection, allowing work handlers to access tunnel structures that have already been torn down. A local attacker could trigger this timing window during power management transitions to cause a kernel crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity for Red Hat products because triggering the condition requires local unprivileged access on systems equipped with active Thunderbolt hardware, and the potential impact is restricted to a system denial of service. Standard enterprise server deployments rarely employ Thunderbolt controllers or DisplayPort tunneling peripherals, which minimizes practical exposure in common production environments. Exploitation additionally relies on winning a race condition during power management transitions such as system sleep or bus shutdown, posing no threat to data confidentiality or system integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.