CVE-2026-97510thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() If tb_cfg_request() fails setting up the request (for example the control channel is shut down already) it returns an error without calling the callback. To avoid leaking that memory, call tb_cfg_request_put() if tb_cfg_request() fails.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d1ff70241a275133e1a0258b7c23588b122276c8 before dbc8a8dd7c1930043c473818fcadcf88cb5e1c4d; from d1ff70241a275133e1a0258b7c23588b122276c8 before 487ee7dbad21d1e757f5dd490ac182aebfa5f689; from d1ff70241a275133e1a0258b7c23588b122276c8 before 000189b249e45e63ee873d0c59c3be1805349681; from d1ff70241a275133e1a0258b7c23588b122276c8 before 9d6657674919bef57c8a7195170263f3456e9876; from d1ff70241a275133e1a0258b7c23588b122276c8 before 42dddadf6b6131af4d12bfa8bdc84ef954e8cef8; from d1ff70241a275133e1a0258b7c23588b122276c8 before 0325d017bf4354a015a02413ee1c7e51266cecf4; from d1ff70241a275133e1a0258b7c23588b122276c8 before 4c63f29872cb444b33665348bbd2f45cab06afcd | CNA record |
References
- https://git.kernel.org/stable/c/dbc8a8dd7c1930043c473818fcadcf88cb5e1c4d
- https://git.kernel.org/stable/c/487ee7dbad21d1e757f5dd490ac182aebfa5f689
- https://git.kernel.org/stable/c/000189b249e45e63ee873d0c59c3be1805349681
- https://git.kernel.org/stable/c/9d6657674919bef57c8a7195170263f3456e9876
- https://git.kernel.org/stable/c/42dddadf6b6131af4d12bfa8bdc84ef954e8cef8
- https://git.kernel.org/stable/c/0325d017bf4354a015a02413ee1c7e51266cecf4
- https://git.kernel.org/stable/c/4c63f29872cb444b33665348bbd2f45cab06afcd
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.