CVE-2026-74691

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.17

Description An issue exists in the thunderbolt network driver where the teardown sequence is performed in the incorrect order. The tbnet tear down() function stops the rings and frees frame buffers before calling tb xdomain disable paths(). Because tb ring stop() zeroes the ring's descriptor base and tbnet free buffers() unmaps the pages, data in flight has nowhere to drain when tb path deactivate hop() polls the pending bit. On certain hardware, such as the ASMedia ASM4242 host router, this causes the pending bit to never clear, leading to a timeout in tb path deactivate hop(). Repeated occurrences of this failure can disable the XDomain control channel, resulting in the loss of the peer node and requiring a power cycle to restore the controller.

Recommendations Update the Linux kernel to version 6.17 or later to ensure DMA paths are deactivated before stopping the rings during the teardown process.