CVE-2026-98896

We process hotplug events in a workqueue that may run after the domain has been removed by tb_domain_remove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by taking the domain reference before scheduling the hotplug handler in tb_queue_hotplug().

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98896.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

d6cc51cd1a4aed1d9e2dd66d643d729acb4be560

Fixed

06b2e894e640f6a3dbeb536a2d26d72426b26a46

Fixed

1d991f749a8255ee2ecc6307e2f27354ab631827

Fixed

e8656465d08ed832e120c9cca4a6d0c8ccb45698

Fixed

b61a4ae2ec6a0d363615d01106e0a2d284133a38

Fixed

04df2985159e381c88a923fae1bec2f8d0272412

Fixed

0a87af3b1e3aa2e09d160848daf0c39e765b73de

Fixed

138ec65b2c761f065b19d115aed2b8246fc272f5

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98896.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.17.0

Fixed

5.10.271

Type: ECOSYSTEM
Events: Introduced

5.11.0

Fixed

5.15.222

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.1.189

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.158

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.111

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.53

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98896.json"