Skip to main content

Linux Kernel CVE-2026-97509

| EUVDEUVD-2026-86107 HIGH
2026-09-24 Linux GHSA-mm3q-r4c7-69f3
Information Disclosure Linux Red Hat Suse
High
Disputed · 8.8 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attach malicious Thunderbolt peer device
  2. Delivery
    Establish XDomain P2P service
  3. Exploit
    Trigger service teardown/release race
  4. Execution
    Dangling reference to freed XDomain ID
  5. Impact
    Kernel use-after-free panic (DoS)

Vulnerability Assessment

Exploitation Conditions

Requires a system with the Thunderbolt driver active and a Thunderbolt XDomain (host-to-host / peer) connection established, so an attacker needs a physically attached Thunderbolt device or peer host and must drive the service registration/teardown path to trigger the released-reference race. Exploitation is limited by the need for physical Thunderbolt presence, the internal teardown-path nature of the bug (not a simple remote trigger), and the fact that the practical outcome is a kernel crash rather than reliable code execution or data disclosure.
Impact

The input CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.8) is significantly overstated for what the patch actually describes. This is a Thunderbolt XDomain reference-counting/lifetime bug: the service ID is released in tb_service_release() while the ID array is owned by the parent XDomain, meaning a service can outlive or race the XDomain object it depends on - a classic use-after-free/premature-release class defect (despite CWE listed as N/A and the tag 'Information Disclosure'). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The AV:A (adjacent) rating is questionable: Thunderbolt XDomain (host-to-host / peer device) connectivity is a physically-attached bus, so real-world reachability is closer to physical/local than network-adjacent, and the flaw lives in a device teardown/service-release path that is not straightforwardly attacker-steered. The realistic outcome is a kernel crash (DoS) on a machine with a Thunderbolt peer connection, not the confirmed high-confidentiality/high-integrity impact the vector claims. Net: high nominal CVSS but low real-world priority for most environments - verify impact with the kernel maintainers, as the C:H/I:H claim is not supported by the description.
Exploit ScenarioDerived

An attacker with a Thunderbolt device or host physically connected to the target establishes and tears down an XDomain P2P service, triggering the service-ID release while the parent XDomain ID array is still referenced, leading to a use-after-free and likely kernel panic. No public exploit code exists, and reliably steering the freed memory to achieve anything beyond a crash would require additional primitives not evidenced in the report.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

The Linux kernel's Thunderbolt XDomain (host-to-host / peer) service handling carries a lifetime defect: the service ID is released in tb_service_release() while the ID array that backs it is owned by the parent XDomain, so a service can outlive the XDomain reference it depends on and teardown of a Thunderbolt connection can access a freed/absent parent structure. The assessed practical outcome is a kernel crash (denial of service) with only limited integrity impact, and reaching the bug requires a system with the Thunderbolt driver active plus a physically attached Thunderbolt device or peer host to establish the XDomain connection - the supplied CVSS 8.8 vector (AV:A/AC:L, C:H/I:H/A:H) is significantly overstated versus the assessed physical-access, high-complexity vector (AV:P/AC:H, C:N/I:L/A:H). Vendor patches are available for the stable trees and mainline (5.10.266, 5.15.217, 6.12.111, 6.18.53, and 7.2), and no public exploit code was identified at time of analysis.

RemediationAI

Apply the vendor-released kernel patch by upgrading to a fixed kernel version: 5.10.266, 5.15.217, 6.12.111 or 6.18.53 on the corresponding stable branches, or mainline 7.2; the upstream stable commits listed in the references (for example https://git.kernel.org/stable/c/a4567e5380e4e46d0ea9a28d2d675e5c6f013d54) can be cherry-picked if a distribution backport is preferable, and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-97509 should be tracked for updated distribution advisories. Because the assessed exploit path requires physical Thunderbolt attachment and an established XDomain connection, prioritise patching on laptops, workstations and servers where Thunderbolt/USB4 ports are physically accessible to untrusted people. If immediate patching is not possible, the most direct compensating control is to stop the Thunderbolt driver from loading (for example blacklisting the 'thunderbolt' module), which removes the attack surface entirely but disables Thunderbolt/USB4 hotplug, docking, daisy-chaining, and Thunderbolt host-to-host networking while in place; a less disruptive option is to disable Thunderbolt peer-to-peer/host-to-host networking and use the firmware Thunderbolt security levels (e.g. 'user' or 'secure' rather than 'none') together with IOMMU/DMA remapping to reduce what a physically attached device can do, though these measures limit rather than eliminate the teardown-path trigger. Physical port control and port-blocking hardware locks remain useful adjuncts given the physical-access prerequisite, but none of these workarounds substitute for the kernel update.

Affected VersionsENISA

Linux patch: 5.10.266
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <ea60ae6233ca0fc0d414e9c11f0d86c63b303fc7
Linux 0 <6.12.111
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <daeaa6c7211d03ed061b0dd22a875fad9372b090
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <8ab12d015884b8aa85ea7ed58c5a0bae4264fe60
Linux patch: 7.2
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <a4567e5380e4e46d0ea9a28d2d675e5c6f013d54
Linux patch: 6.12.111
Linux patch: 6.18.53
Linux 0 <6.18.53
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <8b4060998637f06975fceee9b73845d8672d411e
Linux 0 <5.15.217
Linux 0 <5.10.266
Linux patch: 5.15.217

Affected Packages

euvd linux fix: 5.10.266, 5.15.217, 6.12.111, 6.18.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Thunderbolt/USB4 hardware supports an XDomain protocol that lets two hosts (or a host and a peer device) talk to each other directly, which is the basis for Thunderbolt networking and peer-to-peer DMA paths. In the kernel's drivers/thunderbolt subsystem, an XDomain object owns the ID bitmap/array used to allocate service identifiers, and individual services are registered against that parent. The flaw is a lifetime/reference-counting error in this parent-child relationship: tb_service_release() frees the service ID but the fix note states that an XDomain reference must be held for the entire lifetime of the service, implying that without the fix the service can operate on or release resources belonging to an XDomain that is no longer guaranteed to be alive, producing a dangling-reference class of defect. The supplied CWE field is empty, but the pattern matches the classic use-after-free / improper resource-lifetime family rather than a memory-safety flaw in packet parsing. The affected CPE data is the generic cpe:2.3:a:linux:linux entry, and because the EUVD affected-version data traces the vulnerable code back to commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (the initial kernel git import), essentially every kernel release before the listed fix versions contains the vulnerable shape. The assessed vector (AV:P/AC:H) reflects that a physically attached Thunderbolt device or peer host is required and that the service registration/teardown path must be driven to reach the race, which limits this to local/physical attackers rather than network-adjacent ones.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY 8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 4.8 MEDIUM

Thunderbolt XDomain is a physically-attached bus (AV:P), the bug is a hard-to-steer teardown race (AC:H), and impact is crash-dominant (A:H) with no real confidentiality (C:N).

3.1 AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
4.0 AV:P/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 6.8 MEDIUM
AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Red Hat 5.5 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 05:23 NVD
8.8 (HIGH)
Patch available
Sep 24, 2026 - 17:03 EUVD
CVE Published
Sep 24, 2026 - 16:05 cve.org
UNKNOWN (no severity yet)
CVE Published
Sep 24, 2026 - 16:05 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Keep XDomain reference during the lifetime of a service

This is needed because we release the service ID in tb_service_release() and the ID array is owned by the parent XDomain.

Executive ViewAI

Why It Matters

A high-severity flaw in the Linux kernel's Thunderbolt host-to-host (XDomain) service handling can cause affected servers and workstations to crash when a Thunderbolt connection is torn down, creating a localized denial-of-service risk rather than a data compromise. The practical exposure is narrow: an attacker must already have physical access to the machine and attach a malicious or compromised Thunderbolt device or peer host, so leadership should treat this primarily as a physical-access resilience and availability issue for laptops, engineering workstations, and Thunderbolt-connected lab or field systems. Vendor fixes are already published, making remediation a routine patch-management exercise rather than an emergency incident.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 87% exploitable
Prevalence
Ubiquitous
Linux kernel is ubiquitous, though the Thunderbolt XDomain subsystem is niche
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Controlled
Automatable· derived
No
Human Impact
Medium

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-97509 ADVISORY https://ubuntu.com/security/notices/USN-8886-1 ADVISORY https://vuldb.com/vuln/409677 REF https://git.kernel.org/stable/c/57359bb31526c2f1bb0a7b9b69d8b8a6bd3f0e9f REF https://git.kernel.org/stable/c/8ab12d015884b8aa85ea7ed58c5a0bae4264fe60 REF https://git.kernel.org/stable/c/8b4060998637f06975fceee9b73845d8672d411e REF https://git.kernel.org/stable/c/a4567e5380e4e46d0ea9a28d2d675e5c6f013d54 REF https://git.kernel.org/stable/c/cca72fe513f3d6b1279fe83483f8a8990adbe0c6 REF https://git.kernel.org/stable/c/daeaa6c7211d03ed061b0dd22a875fad9372b090 REF https://git.kernel.org/stable/c/ea60ae6233ca0fc0d414e9c11f0d86c63b303fc7

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy