https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 03 Nov 2026 09:23:53 +0000 https://db.gcve.eu/vuln/cve-2026-98690 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>thunderbolt: Fix domain reference leak when DPRX read is canceled</p> <p>tb_tunnel_one_dp() takes a domain reference which is only dropped once tb_dp_tunnel_active() has run on the work queue. If that work is cancelled that reference is leaked. Since commit f5cc545f5969 (&#34;thunderbolt: Wait for tb_domain_release() to complete when driver is removed&#34;) instead of just leaking memory this now also blocks in the completion wait forever when unbinding the driver.</p> <p>This can be triggered whenever a DP tunnel is torn down before the DPRX read has completed, e.g. by unplugging within the timeout, and then unbinding the driver.</p> <p>That reference only exists to keep the domain around while the DPRX work is scheduled so let the work itself own it: take it in tb_dp_dprx_start() and drop it in both places that end the work. Get/put are then paired inside the same file and it doesn&#39;t matter anymore if the callback ever runs.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>thunderbolt: Fix domain reference leak when DPRX read is canceled</p> <p>tb_tunnel_one_dp() takes a domain reference which is only dropped once tb_dp_tunnel_active() has run on the work queue. If that work is cancelled that reference is leaked. Since commit f5cc545f5969 (&#34;thunderbolt: Wait for tb_domain_release() to complete when driver is removed&#34;) instead of just leaking memory this now also blocks in the completion wait forever when unbinding the driver.</p> <p>This can be triggered whenever a DP tunnel is torn down before the DPRX read has completed, e.g. by unplugging within the timeout, and then unbinding the driver.</p> <p>That reference only exists to keep the domain around while the DPRX work is scheduled so let the work itself own it: take it in tb_dp_dprx_start() and drop it in both places that end the work. Get/put are then paired inside the same file and it doesn&#39;t matter anymore if the callback ever runs.</p> https://db.gcve.eu/vuln/cve-2026-98690