CVE-2026-97508

CVE-2026-97508

High · published September 24, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
12.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Set tb->root_switch to NULL when domain is stopped

Similarly what we do with the firmware connection manager. This makes

tb_xdp_handle_request() return error to the remote host. However, we

need to make sure we keep the uuid alive so that we can reply until the

whole domain is released.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.4th percentile
Published
2026-09-24T21:17Z
References (7)
https://git.kernel.org/stable/c/54ad3415cc211ca0d64ae1bf3234d6eb5c6aedd0 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/66b0fe27e277713c2b9f3c452c76330ed0bd7eaf · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/83d1af5b1b6e6c96ffa633ca2c9a77f6f4c93efa · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/99f019d2e9eb79adc485fef8aa8ada2cd0c843e9 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d9a638e7bc87e0e6fe3a75517ac481e72fc0058c · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e56249d8a68e712f3b60e1f3fdbb5b4fea146468 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f06e9fbae78a51832211b4495a19412c7d49ecb4 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 24 SEP 16:04Z
    thunderbolt: Set tb->root_switch to NULL when domain is stopped
    cvelistv5