SB20260816131 - Use-after-free in Linux kernel thunderbolt xdomain delayed work handling in tb_xdp_handle_request() and update_xdomain()

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-74575)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the thunderbolt xdomain delayed work handling in tb_xdp_handle_request() and update_xdomain() when queuing delayed work concurrently with xdomain disconnect and removal. A local user can trigger crafted xdomain requests or state changes during disconnect to cause a denial of service.

The issue arises because the request handler runs on the system workqueue and is no longer serialized with the remove path.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2aa2cde2cc79a79d8ea4a15be9f4a67fc528ae91
• https://git.kernel.org/stable/c/2c5d2d3c3f70cde2565d7b279b544893a2035842
• https://git.kernel.org/stable/c/33c0ee18cf8665c974b00f4e0ba769fbc07efe10
• https://git.kernel.org/stable/c/54a62153c765cd24239cde1f2633f2a2fd005368
• https://git.kernel.org/stable/c/91b40862a02000f490b63f1d315be3ee31e83871