CVE-2026-74691 Overview
CVE-2026-74691 is a race condition vulnerability in the Linux kernel's Thunderbolt networking driver (net/thunderbolt). The flaw lives in tbnet_tear_down(), which stops DMA rings and frees frame buffers before calling tb_xdomain_disable_paths(). This inverse ordering leaves in-flight DMA traffic with no valid drain target. On affected hardware such as the ASMedia ASM4242 host router, the hop's pending bit never clears, causing __tb_path_deactivate_hop() to hit a 500 ms timeout and return -ETIMEDOUT. Repeated teardowns eventually take the XDomain control channel offline, requiring a power cycle to recover the controller.
Critical Impact
Repeated interface teardowns on Thunderbolt networking links can silently fail, disable the XDomain control channel, and force a hardware power cycle to restore connectivity.
Affected Products
- Linux kernel Thunderbolt networking driver (drivers/net/thunderbolt)
- Systems using ASMedia ASM4242 Thunderbolt host router controllers
- Linux kernel v6.17 and earlier stable branches prior to the referenced fix commits
Discovery Timeline
- 2026-08-22 - CVE-2026-74691 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74691
Vulnerability Analysis
The Thunderbolt networking driver establishes high-speed DMA paths between two XDomain peers over Thunderbolt. Commit ff7cd07f3064 ("net: thunderbolt: Enable DMA paths only after rings are enabled") reordered the setup path so that DMA paths are enabled last, priming the receive ring before packets arrive. The corresponding teardown sequence was never updated to reverse this order.
As a result, tbnet_tear_down() calls tb_ring_stop() and tbnet_free_buffers() before disabling the DMA paths. tb_ring_stop() zeros the ring descriptor base and tbnet_free_buffers() unmaps the pages backing in-flight frames. When __tb_path_deactivate_hop() subsequently polls the hop's pending bit, outstanding transfers have no valid destination and the bit never clears.
The failure path is invisible to callers. __tb_path_deactivate_hops(), tb_path_deactivate(), tb_tunnel_deactivate(), and __tb_disconnect_xdomain_paths() are all void functions, and tb_disconnect_xdomain_paths() unconditionally returns 0. Timing measurements with kretprobes on v6.17 show every teardown burning the full 500 ms timeout before the fix, versus 525 microseconds after.
Root Cause
The root cause is an ordering defect between DMA path deactivation and ring teardown. The teardown path tears down resources in the same order as setup instead of in reverse, violating the invariant that DMA paths must be disabled while their backing rings and buffers remain valid.
Attack Vector
Exploitation requires adjacent network access via a Thunderbolt link. An attacker or fault condition that triggers repeated interface teardowns on the tbnet device, for example by bringing the interface up and down or enslaving it into a bond, can drive the XDomain control channel into an unrecoverable state. This yields a denial-of-service condition affecting host availability and integrity of the Thunderbolt controller until the system is power-cycled.
No verified public exploit code is available. The vulnerability mechanism is described in the upstream commit messages referenced in the Kernel Commit 0da9a6d and related patches.
Detection Methods for CVE-2026-74691
Indicators of Compromise
- Kernel log entries from tb_port_warn() reporting hop deactivation timeouts on Thunderbolt ports.
- __tb_path_deactivate_hop() return values of -ETIMEDOUT observed via kretprobes or ftrace on the thunderbolt subsystem.
- Loss of the XDomain peer node after repeated tbnet interface teardowns, with the peer only recoverable via power cycle.
Detection Strategies
- Instrument __tb_path_deactivate_hop() with kretprobes to capture teardown latency exceeding a few milliseconds, which indicates the stalled pending bit condition.
- Correlate tbnet link-down events with subsequent XDomain disconnect messages in dmesg to spot the failure signature.
- Audit running kernel versions against the fixed stable branch commits listed in the NVD references.
Monitoring Recommendations
- Monitor kernel ring buffer output for thunderbolt subsystem warnings and XDomain disconnect events on hosts with Thunderbolt networking enabled.
- Track link-flap counts on tbnet interfaces, especially when bonded or brought down programmatically.
- Baseline expected tbnet teardown latency and alert on outliers above 100 ms.
How to Mitigate CVE-2026-74691
Immediate Actions Required
- Update to a Linux kernel build that includes one of the fix commits referenced by upstream stable maintainers.
- Inventory hosts using Thunderbolt networking, particularly those with ASMedia ASM4242 controllers, and prioritize their patching.
- Avoid repeated tbnet interface teardowns and bond enslavement operations on unpatched systems until the kernel is updated.
Patch Information
The fix reorders tbnet_tear_down() to deactivate DMA paths before stopping the rings and freeing frame buffers, restoring the setup/teardown symmetry documented in commit ff7cd07f3064. The correction has been merged to multiple stable branches. See the upstream references: Kernel Commit 0da9a6d, Kernel Commit 103a9b66, Kernel Commit 4dd71cb0, Kernel Commit 68bf02b6, Kernel Commit 7cce3910, Kernel Commit 9a482b2b, and Kernel Commit b5a21615.
Workarounds
- Unload the thunderbolt-net module on hosts that do not require Thunderbolt IP networking until patched kernels are deployed.
- Disable Thunderbolt networking in firmware or via kernel command line on affected hosts where the feature is not in use.
- If the XDomain channel has already failed, perform a full power cycle rather than a warm reboot to restore controller state.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
