# CVE-2026-98688: linux: In the Linux kernel, the following vulnerability has been resolved:  thunderbolt: Fix NULL dereference in tb_remove_w...

CVE-2026-98688 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98688 (version 7.2.10-1), released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-98688
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 18, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  thunderbolt: Fix NULL dereference in tb_remove_work()  There is a slight race between tb_remove_work() and tb_domain_remove() which leads to dereferencing a NULL tb->root_switch pointer inside tb_free_unplugged_xdomains():          Thread A                            Thread B    tb_remove_work()                                     tb_domain_remove()                                       mutex_lock(&tb->lock)                                       tb_stop()                                         /* doesn't cancel a running callback */                                         cancel_delayed_work(&tcm->remove_work)                                         ...                                         tb_switch_remove(tb->root_switch)                                         tb->root_switch = NULL                                       mutex_unlock(&tb->lock)     mutex_lock(&tb->lock)     ...     /* without checking ->root_switch */     tb_free_unplugged_xdomains(tb->root_switch)     mutex_unlock(&tb->lock)  Commit a8937f35cf39 ("thunderbolt: Remove XDomain from the bus without holding tb->lock") doesn't seem right to move tb_free_unplugged_xdomains() out of the &tb->lock section and the check for tb->root_switch, in particular.  It states:    For this reason separate removing the XDomain from the topology data   structures (where we need the lock) from unregistering the device from   the bus (where remove callbacks of the drivers are being called).  tb_free_unplugged_xdomains() belongs to the former group of functions requiring the lock.  And it also calls tb_xdomain_remove() which should only be called with &tb->lock held.  Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.10-1 | [DEBIAN-CVE-2026-98688](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98688.md) | Oct 19, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.