CVE-2026-97508

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Set tb->root_switch to NULL when domain is stopped Similarly what we do with the firmware connection manager. This makes tb_xdp_handle_request() return error to the remote host. However, we need to make sure we keep the uuid alive so that we can reply until the whole domain is released.

CVSS 3.1

7.5CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-25)

Published

2026-09-24

Modified

2026-10-03

Record from

the NVD, synced 2026-10-19

References

• https://git.kernel.org/stable/c/54ad3415cc211ca0d64ae1bf3234d6eb5c6aedd0
• https://git.kernel.org/stable/c/66b0fe27e277713c2b9f3c452c76330ed0bd7eaf
• https://git.kernel.org/stable/c/83d1af5b1b6e6c96ffa633ca2c9a77f6f4c93efa
• https://git.kernel.org/stable/c/99f019d2e9eb79adc485fef8aa8ada2cd0c843e9
• https://git.kernel.org/stable/c/d9a638e7bc87e0e6fe3a75517ac481e72fc0058c

Check your stackJSON