---
id: CVE-2026-98689
title: 'thunderbolt: Don''t access a DP tunnel after its DPRX read was canceled'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  thunderbolt: Don't access a DP tunnel after its DPRX read was canceled

  tb_dp_dprx_work() checks ->dprx_canceled before it takes tb->lock so it
  misses a tb_dp_dprx_stop…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d6d458d42e1e1544a18f37f1d5c840e00d5261b9 <
    405a969c0b3356639116db89ab367be1d64b77c0
  - >-
    Linux >= d6d458d42e1e1544a18f37f1d5c840e00d5261b9 <
    2c2fd6a7fd5e1218db7e17336fc1a0393b6949e6
  - >-
    Linux >= d6d458d42e1e1544a18f37f1d5c840e00d5261b9 <
    419fa32fa5bc2d7fb9d0d15d5630b1c1090808b3
  - Linux 6.14
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:46:04.217Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98689'
references:
  - url: 'https://git.kernel.org/stable/c/405a969c0b3356639116db89ab367be1d64b77c0'
  - url: 'https://git.kernel.org/stable/c/2c2fd6a7fd5e1218db7e17336fc1a0393b6949e6'
  - url: 'https://git.kernel.org/stable/c/419fa32fa5bc2d7fb9d0d15d5630b1c1090808b3'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.527Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Don't access a DP tunnel after its DPRX read was canceled

tb_dp_dprx_work() checks ->dprx_canceled before it takes tb->lock so it
misses a tb_dp_dprx_stop() that could not cancel the already running
work. It then polls the DPRX capabilities and runs the callback for a
tunnel that has already been torn down while the domain is suspending or
going away.

This can be hit by cancelling the DPRX read from outside the ordered
tb->wq: During suspend tb_disconnect_and_release_dp() does just this and
with a later patch tb_stop() will do it as well. The latter in combination
with the Apple NHI where the DPRX read never completed is how I hit
this.

Check the flag with tb->lock held instead and check it again in
tb_dp_tunnel_active() because the callback runs after the lock has been
dropped again.

Also clear the flag in tb_dp_dprx_start() so that it only ever describes
the work that is currently in flight.

## Affected

- `Linux >= d6d458d42e1e1544a18f37f1d5c840e00d5261b9 < 405a969c0b3356639116db89ab367be1d64b77c0`
- `Linux >= d6d458d42e1e1544a18f37f1d5c840e00d5261b9 < 2c2fd6a7fd5e1218db7e17336fc1a0393b6949e6`
- `Linux >= d6d458d42e1e1544a18f37f1d5c840e00d5261b9 < 419fa32fa5bc2d7fb9d0d15d5630b1c1090808b3`
- `Linux 6.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.