Linux Kernel EUVD-2026-86106

Requires a physical Thunderbolt/USB4 peer connection to the victim host and the Thunderbolt subsystem (thunderbolt driver / XDP cross-domain protocol) to be active - i.e., a laptop or workstation with an enabled TB port. Exploitation further depends on a race window: a remote XDP request (tb_xdp_handle_request) must be processed while the domain is being stopped/released, before the uuid is torn down. Limiting factors: adjacency (attacker must be physically attached over Thunderbolt), high attack complexity (timing-dependent teardown race), and hardware scope limited to Thunderbolt-capable systems. No authentication is required per the CVSS vector (PR:N), but the physical-access and race requirements sharply constrain realistic exploitation.

The input assigns CVSS 3.1 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but this vector overstates the real-world impact. The fix simply NULLs tb->root_switch when a Thunderbolt domain is stopped so that tb_xdp_handle_request() returns an error to a remote host instead of dereferencing a stale/torn-down switch pointer - a classic memory-safety hardening (null-deref / potential use-after-free during teardown), not an information-disclosure primitive. The C:H/I:H rating is not supported by the description; the realistic worst case is a kernel crash (DoS). Exploitation signals are weak: no EPSS score, not in CISA KEV, and no public exploit identified. Attack complexity is genuinely high (AC:H) because it depends on a teardown race - a remote XDP request must arrive precisely as the domain is being released - and the attack vector is Adjacent (AV:A) requiring a physical Thunderbolt peer connection, not network reach. Net assessment: a legitimate latent kernel bug worth patching in the normal stable-update cadence, but a LOW real-world priority, not a high-urgency issue despite the 7.5 label. Conflict to note explicitly: the 'Information Disclosure' tag and C:H/I:H metrics conflict with the code change, which is availability/crash-oriented.

An attacker connects a malicious Thunderbolt/USB4 device or host to the victim's Thunderbolt port and issues cross-domain (XDP) protocol requests. If the victim's domain is torn down (cable unplug, suspend, or driver stop) while an XDP request is being handled, the kernel dereferences the freed/stale root_switch, potentially causing a use-after-free or null dereference and a kernel panic. No public exploit code is identified, and the timing-dependent teardown race (AC:H) makes reliable triggering difficult.