CVE-2026-97508
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Set tb->root_switch to NULL when domain is stopped Similarly what we do with the firmware connection manager. This makes tb_xdp_handle_request() return error to the remote host. However, we need to make sure we keep the uuid alive so that we can reply until the whole domain is released.
- Published Sep 24, 2026
- CVSS 7.5 high
- 0.2% chance of exploitation in the next 30 days (EPSS)
- A fix is available