CVE-2026-98691

A flaw was found in the Linux kernel's Thunderbolt subsystem. This vulnerability can lead to a Denial of Service (DoS) or system instability when a Thunderbolt device is disconnected or unbound. When a Thunderbolt domain is stopped, inactive DisplayPort (DP) tunnels are not properly torn down, allowing scheduled background tasks to continue running after the domain has been dismantled. A local privileged user or physically present attacker can trigger this flaw by unbinding or disconnecting a device during DisplayPort tunnel initialization, causing the domain removal process to hang or execute callbacks against torn-down resources.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.