{ "cveId": "CVE-2026-98694", "url": "https://patchblox.com/security/cve/CVE-2026-98694", "summary": "CVE-2026-98694 is fixed in 12 products on 1 platform, first by DEBIAN-CVE-2026-98694, released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.", "title": "thunderbolt: Fix KASAN reported use-after-free when request is canceled", "description": "In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation (stripped down keeping the relevant parts): BUG: KASAN: slab-use-after-free in tb_cfg_request_sync\u002B0x240/0x250 [thunderbolt] Read of size 24 at addr ffff88811067f290 by task kworker/u40:2/1760 \u003CTASK\u003E tb_cfg_request_sync\u002B0x240/0x250 [thunderbolt] tb_cfg_read_raw\u002B0x367/0x510 [thunderbolt] tb_cfg_read\u002B0xec/0x240 [thunderbolt] tb_port_get_link_generation\u002B0x258/0x420 [thunderbolt] tb_usb3_consumed_bandwidth\u002B0x1c1/0x2c0 [thunderbolt] tb_tunnel_consumed_bandwidth\u002B0xfd/0x910 [thunderbolt] tb_available_bandwidth\u002B0x5f2/0xeb0 [thunderbolt] tb_recalc_estimated_bandwidth\u002B0x2a0/0x1bc0 [thunderbolt] tb_handle_dp_bandwidth_request\u002B0x1897/0x5e20 [thunderbolt] process_one_work\u002B0x675/0x1230 worker_thread\u002B0x5e6/0xf70 kthread\u002B0x365/0x470 ret_from_fork\u002B0x54d/0x710 ret_from_fork_asm\u002B0x1a/0x30 \u003C/TASK\u003E Allocated by task 1760: __kmalloc_cache_noprof\u002B0x1ee/0x550 tb_cfg_read_raw\u002B0x1d3/0x510 [thunderbolt] tb_cfg_read\u002B0xec/0x240 [thunderbolt] tb_port_get_link_generation\u002B0x258/0x420 [thunderbolt] tb_usb3_consumed_bandwidth\u002B0x1c1/0x2c0 [thunderbolt] tb_tunnel_consumed_bandwidth\u002B0xfd/0x910 [thunderbolt] tb_available_bandwidth\u002B0x5f2/0xeb0 [thunderbolt] tb_recalc_estimated_bandwidth\u002B0x2a0/0x1bc0 [thunderbolt] tb_handle_dp_bandwidth_request\u002B0x1897/0x5e20 [thunderbolt] process_one_work\u002B0x675/0x1230 worker_thread\u002B0x5e6/0xf70 kthread\u002B0x365/0x470 ret_from_fork\u002B0x54d/0x710 ret_from_fork_asm\u002B0x1a/0x30 Freed by task 926: kfree\u002B0x18f/0x4a0 tb_cfg_request_put\u002B0xb7/0xe0 [thunderbolt] tb_cfg_request_work\u002B0x82/0x120 [thunderbolt] process_one_work\u002B0x675/0x1230 worker_thread\u002B0x5e6/0xf70 kthread\u002B0x365/0x470 ret_from_fork\u002B0x54d/0x710 ret_from_fork_asm\u002B0x1a/0x30 Second to last potentially related work creation: __queue_work\u002B0x575/0xd00 queue_work_on\u002B0x77/0x80 tb_cfg_request_cancel\u002B0xc7/0x260 [thunderbolt] tb_cfg_request_sync\u002B0x1f6/0x250 [thunderbolt] tb_cfg_read_raw\u002B0x367/0x510 [thunderbolt] tb_cfg_read\u002B0xec/0x240 [thunderbolt] tb_port_get_link_generation\u002B0x258/0x420 [thunderbolt] tb_usb3_consumed_bandwidth\u002B0x1c1/0x2c0 [thunderbolt] tb_tunnel_consumed_bandwidth\u002B0xfd/0x910 [thunderbolt] tb_available_bandwidth\u002B0x5f2/0xeb0 [thunderbolt] tb_recalc_estimated_bandwidth\u002B0x2a0/0x1bc0 [thunderbolt] tb_handle_dp_bandwidth_request\u002B0x1897/0x5e20 [thunderbolt] process_one_work\u002B0x675/0x1230 worker_thread\u002B0x5e6/0xf70 kthread\u002B0x365/0x470 ret_from_fork\u002B0x54d/0x710 ret_from_fork_asm\u002B0x1a/0x30 The last stack trace is helpful because it shows that we are cancelling a request and looking at tb_cfg_request_cancel() what might happen is that tb_cfg_request_work() completes right before tb_cfg_request_cancel() starts and because of this it will call schedule_work() queueing the same work to run again. However, it is already removed from the request_queue and reference count is dropped so when tb_cfg_request_work() triggers again it will access memory that is already released. Fix this so that we first make sure a cancelled request is not handed away from tb_cfg_request_find() or scheduled to run. Then instead of relying on the worker to clean up the request we will do it in tb_cfg_request_cancel() after the work is canceled from running. Make tb_cfg_request_dequeue() release the request only if it was actually removed from the queue.", "published": "2026-10-18T16:17:22Z", "severity": "Moderate", "cvss": 5.2, "epss": 0.00176, "epssPercentile": 0.07199, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98694", "fixes": [ { "platform": "linux", "product": "kernel-64kb", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-azure", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-default", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1.150700.17.51.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-docs", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-livepatch-SLE15-SP7_Update_24", "release": "sles 15.7", "fixedVersion": "1-150700.15.3.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-obs-build", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-source", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-syms", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.12.113-1", "fix": "DEBIAN-CVE-2026-98694", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98694", "released": "2026-10-19T16:27:52Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "7.2.10-1", "fix": "DEBIAN-CVE-2026-98694", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98694", "released": "2026-10-19T16:27:52Z" }, { "platform": "linux", "product": "linux-6.12", "release": "Debian 12.15 (bookworm)", "fixedVersion": "6.12.113-1~deb12u1", "fix": "DEBIAN-CVE-2026-98694", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98694", "released": "2026-10-19T16:27:52Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T13:06:02Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }