All vulnerabilities
CVE-2026-97510

Linux: thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in487ee7dbad21d1e757f5dd490ac182aebfa5f689Also 000189b249e45e63ee873d0c59c3be1805349681, 9d6657674919bef57c8a7195170263f3456e9876 and 3 moreCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 487ee7dbad21d1e757f5dd490ac182aebfa5f689LinuxCVE List
  • 000189b249e45e63ee873d0c59c3be1805349681LinuxCVE List
  • 9d6657674919bef57c8a7195170263f3456e9876LinuxCVE List
  • 42dddadf6b6131af4d12bfa8bdc84ef954e8cef8LinuxCVE List
  • 0325d017bf4354a015a02413ee1c7e51266cecf4LinuxCVE List
  • 4c63f29872cb444b33665348bbd2f45cab06afcdLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()

If tb_cfg_request() fails setting up the request (for example the control channel is shut down already) it returns an error without calling the callback. To avoid leaking that memory, call tb_cfg_request_put() if tb_cfg_request() fails.

Text from CVE List

Affected versions 16

  • Linuxaffected: d1ff70241a275133e1a0258b7c23588b122276c8 before dbc8a8dd7c1930043c473818fcadcf88cb5e1c4dCVE List
  • Linuxaffected: d1ff70241a275133e1a0258b7c23588b122276c8 before 487ee7dbad21d1e757f5dd490ac182aebfa5f689CVE List
  • Linuxaffected: d1ff70241a275133e1a0258b7c23588b122276c8 before 000189b249e45e63ee873d0c59c3be1805349681CVE List
  • Linuxaffected: d1ff70241a275133e1a0258b7c23588b122276c8 before 9d6657674919bef57c8a7195170263f3456e9876CVE List
  • Linuxaffected: d1ff70241a275133e1a0258b7c23588b122276c8 before 42dddadf6b6131af4d12bfa8bdc84ef954e8cef8CVE List
  • Linuxaffected: d1ff70241a275133e1a0258b7c23588b122276c8 before 0325d017bf4354a015a02413ee1c7e51266cecf4CVE List
  • Linuxaffected: d1ff70241a275133e1a0258b7c23588b122276c8 before 4c63f29872cb444b33665348bbd2f45cab06afcdCVE List
  • Linuxaffected: 4.15CVE List
  • Linuxunaffected: all versions before 4.15CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 7