CVE-2026-98689: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled

CVE-2026-98689: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Don't access a DP tunnel after its DPRX read was canceled

tb_dp_dprx_work() checks ->dprx_canceled before it takes tb->lock so it
misses a tb_dp_dprx_stop() that could not cancel the already running
work. It then polls the DPRX capabilities and runs the callback for a
tunnel that has already been torn down while the domain is suspending or
going away.

This can be hit by cancelling the DPRX read from outside the ordered
tb->wq: During suspend tb_disconnect_and_release_dp() does just this and
with a later patch tb_stop() will do it as well. The latter in combination
with the Apple NHI where the DPRX read never completed is how I hit
this.

Check the flag with tb->lock held instead and check it again in
tb_dp_tunnel_active() because the callback runs after the lock has been
dropped again.

Also clear the flag in tb_dp_dprx_start() so that it only ever describes
the work that is currently in flight.

The Linux kernel CVE team has assigned CVE-2026-98689 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.14 with commit d6d458d42e1e1544a18f37f1d5c840e00d5261b9 and fixed in 6.18.56 with commit 405a969c0b3356639116db89ab367be1d64b77c0
	Issue introduced in 6.14 with commit d6d458d42e1e1544a18f37f1d5c840e00d5261b9 and fixed in 7.2.10 with commit 2c2fd6a7fd5e1218db7e17336fc1a0393b6949e6
	Issue introduced in 6.14 with commit d6d458d42e1e1544a18f37f1d5c840e00d5261b9 and fixed in 7.3-rc6 with commit 419fa32fa5bc2d7fb9d0d15d5630b1c1090808b3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-98689
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/thunderbolt/tb.c
	drivers/thunderbolt/tunnel.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/405a969c0b3356639116db89ab367be1d64b77c0
	https://git.kernel.org/stable/c/2c2fd6a7fd5e1218db7e17336fc1a0393b6949e6
	https://git.kernel.org/stable/c/419fa32fa5bc2d7fb9d0d15d5630b1c1090808b3