Use-after-free in Linux kernel - CVE-2026-74575

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the thunderbolt xdomain delayed work handling in tb_xdp_handle_request() and update_xdomain() when queuing delayed work concurrently with xdomain disconnect and removal. A local user can trigger crafted xdomain requests or state changes during disconnect to cause a denial of service.

The issue arises because the request handler runs on the system workqueue and is no longer serialized with the remove path.

Affected software

How to mitigate CVE-2026-74575

External References

• https://git.kernel.org/stable/c/2aa2cde2cc79a79d8ea4a15be9f4a67fc528ae91
• https://git.kernel.org/stable/c/2c5d2d3c3f70cde2565d7b279b544893a2035842
• https://git.kernel.org/stable/c/33c0ee18cf8665c974b00f4e0ba769fbc07efe10
• https://git.kernel.org/stable/c/54a62153c765cd24239cde1f2633f2a2fd005368
• https://git.kernel.org/stable/c/91b40862a02000f490b63f1d315be3ee31e83871

Related Security Bulletins

• Use-after-free in Linux kernel thunderbolt xdomain delayed work handling in tb_xdp_handle_request() and update_xdomain()
• Debian update for linux