CVE-2026-98896

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Keep the domain reference while processing hotplug

We process hotplug events in a workqueue that may run after the domain has been removed by tb domain remove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tb handle hotplug() to run. Avoid possible UAF in this case by taking the domain reference before scheduling the hotplug handler in tb queue hotplug().