CVE-2026-97508

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-97508
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97508.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-97508
Downstream
Published
2026-09-24T16:04:58Z
Modified
2026-10-05T02:30:19Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
thunderbolt: Set tb->root_switch to NULL when domain is stopped
Details

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Set tb->root_switch to NULL when domain is stopped

Similarly what we do with the firmware connection manager. This makes tb_xdp_handle_request() return error to the remote host. However, we need to make sure we keep the uuid alive so that we can reply until the whole domain is released.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97508.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d1ff70241a275133e1a0258b7c23588b122276c8
Fixed
d9a638e7bc87e0e6fe3a75517ac481e72fc0058c
Fixed
66b0fe27e277713c2b9f3c452c76330ed0bd7eaf
Fixed
54ad3415cc211ca0d64ae1bf3234d6eb5c6aedd0
Fixed
83d1af5b1b6e6c96ffa633ca2c9a77f6f4c93efa
Fixed
f06e9fbae78a51832211b4495a19412c7d49ecb4
Fixed
99f019d2e9eb79adc485fef8aa8ada2cd0c843e9
Fixed
e56249d8a68e712f3b60e1f3fdbb5b4fea146468

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97508.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.15.0
Fixed
5.10.271
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.222
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.189
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.158
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.111
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.53

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97508.json"