Riskcovery

CVE-2026-89737

usb: typec: thunderbolt: Disable work before freeing tbt on remove

State
Published
Severity
Not scored
Published
Sep 11, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: thunderbolt: Disable work before freeing tbt on remove

tbt_altmode_remove() drops the plug and cable references without draining tbt->work. The work function dereferences those references, and can also requeue itself in its error path. The VDM callbacks can queue the same work item.

Disable and drain tbt->work before dropping the references. This waits for an existing invocation and prevents subsequent schedule_work() calls from queueing it during teardown.

This issue was found by an in-house static analysis tool and confirmed by manual code review.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 100e257386595b3f1865ca8a991e2ba74f9701ff to before ebb840d982a612261cfc8a7687735a140c6c7024Affected
  • 100e257386595b3f1865ca8a991e2ba74f9701ff to before 0a25484fe22f621e151367a59a82330a22ac80bcAffected
  • 100e257386595b3f1865ca8a991e2ba74f9701ff to before 92090f6ff2acc81e9dd99881dcfb4f8c1bdaabd3Affected
LinuxLinux
  • 6.14Affected
  • before 6.14Not affected
  • 6.18.50 through 6.18.*Not affected
  • 7.2.4 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.