CVE-2026-89737

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the USB Type-C Thunderbolt implementation where the tbt altmode remove() function drops plug and cable references without draining tbt->work. Because the work function dereferences these references and can requeue itself during error paths or via VDM callbacks, this can lead to a use-after-free scenario during teardown.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.