Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-98896 Details

Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tb_domain_remove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by taking the domain reference before scheduling the hotplug handler in tb_queue_hotplug().

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://git.kernel.org/stable/c/04df2985159e381c88a923fae1bec2f8d0272412 kernel.org
https://git.kernel.org/stable/c/06b2e894e640f6a3dbeb536a2d26d72426b26a46 kernel.org
https://git.kernel.org/stable/c/0a87af3b1e3aa2e09d160848daf0c39e765b73de kernel.org
https://git.kernel.org/stable/c/138ec65b2c761f065b19d115aed2b8246fc272f5 kernel.org
https://git.kernel.org/stable/c/1d991f749a8255ee2ecc6307e2f27354ab631827 kernel.org

see all 7 references

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

No affected product data is available for this CVE.

Change History

2 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-98896
NVD Published Date:
Oct 23, 2026
NVD Last Modified:
Oct 26, 2026
Source:
kernel.org
CVE-2026-98896 Details - Not Deferred