CVE-2026-74575 - Vulnerability Details

- thunderbolt: Prevent XDomain delayed work use-after-free on disconnect

Description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Prevent XDomain delayed work use-after-free on disconnect

tb_xdp_handle_request() runs on system_wq and queues
xd->state_work via queue_delayed_work() in three request handlers:
PROPERTIES_CHANGED_REQUEST, UUID_REQUEST (via start_handshake),
and LINK_STATE_CHANGE_REQUEST. Similarly, update_xdomain() queues
xd->properties_changed_work when local properties change.

Concurrently, tb_xdomain_remove() calls stop_handshake() which does
cancel_delayed_work_sync() on both delayed works. Later,
tb_xdomain_unregister() calls device_unregister() which eventually
frees the xdomain. Since commit 559c1e1e0134 ("thunderbolt: Run
tb_xdp_handle_request() in system workqueue") moved the request
handler off tb->wq, the handler and the remove path are no longer
serialized. If queue_delayed_work() executes after
cancel_delayed_work_sync() but before the xdomain is freed, the
delayed work fires on a freed object.

Add xd->removing that tb_xdomain_remove() sets under xd->lock
before calling stop_handshake(). Each external queue site holds
the same lock and checks removing before calling
queue_delayed_work(). This provides the mutual exclusion needed:
either the queue site acquires the lock first and queues work that
the subsequent cancel will see, or the remove path acquires the
lock first and the queue site observes removing == true and skips
the queue.

Published: 2026-08-15

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This flaw occurs in the Thunderbolt driver when a delayed work task is queued after the domain is removed. The task runs on a system workqueue and accesses a freed domain structure, leading to a use‑after‑free. The immediate effect is memory corruption that could crash the kernel or allow an attacker to execute code if the freed memory is reused. The weakness is a classic use‑after‑free.

Affected Systems

All Linux kernel implementations that include the Thunderbolt subsystem before the commit that adds the removal flag and lock protection are vulnerable. No specific release numbers are listed, so any kernel build with the pre‑commit code for tb_xdp_handle_request, tb_xdomain_remove, and tb_xdomain_unregister is affected. Systems with Thunderbolt devices connected to the kernel are exposed.

Risk and Exploitability

Based on the description, the likely attack vector is local, requiring an attacker to trigger a Thunderbolt disconnect and schedule delayed work. The EPSS score is <1% and the CVSS score 8.8, indicating a high‑severity risk. The vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. Nevertheless, the use‑after‑free can lead to arbitrary code execution or denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`559c1e1e013437bf190469efbcbd8bc803285853`	affected	< d4fa0d544c04dea636bf821ff5582cd7d63e2c34
`559c1e1e013437bf190469efbcbd8bc803285853`	affected	< cfbd2dba3d862c9be8c92bea2a357d9ed828a54a
`559c1e1e013437bf190469efbcbd8bc803285853`	affected	< dc11d5118f9da6ea28487ffe055de5a0d0734125
`559c1e1e013437bf190469efbcbd8bc803285853`	affected	< 91b40862a02000f490b63f1d315be3ee31e83871
`559c1e1e013437bf190469efbcbd8bc803285853`	affected	< 33c0ee18cf8665c974b00f4e0ba769fbc07efe10
`559c1e1e013437bf190469efbcbd8bc803285853`	affected	< 54a62153c765cd24239cde1f2633f2a2fd005368
`559c1e1e013437bf190469efbcbd8bc803285853`	affected	< 2aa2cde2cc79a79d8ea4a15be9f4a67fc528ae91
`559c1e1e013437bf190469efbcbd8bc803285853`	affected	< 2c5d2d3c3f70cde2565d7b279b544893a2035842

Linux

affected

Version	Status	Constraints
`5.2`	affected	—
`0`	unaffected	< 5.2
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.151`	unaffected	≤ 6.6.*
`6.12.103`	unaffected	≤ 6.12.*
`6.18.44`	unaffected	≤ 6.18.*
`7.1.8`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[559c1e1e013437bf190469efbcbd8bc803285853,91b40862a02000f490b63f1d315be3ee31e83871)`	affected	code_commit	—
`[559c1e1e013437bf190469efbcbd8bc803285853,33c0ee18cf8665c974b00f4e0ba769fbc07efe10)`	affected	code_commit	—
`[559c1e1e013437bf190469efbcbd8bc803285853,54a62153c765cd24239cde1f2633f2a2fd005368)`	affected	code_commit	—
`[559c1e1e013437bf190469efbcbd8bc803285853,2aa2cde2cc79a79d8ea4a15be9f4a67fc528ae91)`	affected	code_commit	—
`[559c1e1e013437bf190469efbcbd8bc803285853,2c5d2d3c3f70cde2565d7b279b544893a2035842)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.2`	affected	generic	—
`[0,5.2)`	unaffected	generic	—
`[6.6.151,6.7.0)`	unaffected	semver	—
`[6.12.103,6.13.0)`	unaffected	semver	—
`[6.18.44,6.19.0)`	unaffected	semver	—
`[7.1.8,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that contains the fix for the thunderbolt UAF, applying the vendor‑supplied security update.
If a kernel update is not immediately possible, disable the thunderbolt driver by removing the module or disabling the Thunderbolt plug in the BIOS or kernel boot parameters.
Apply a temporary upstream patch that introduces the xd→removing flag and lock protection until a full update is available.

Generated by OpenCVE AI on August 22, 2026 at 03:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00238.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2aa2cde2cc79a79d8ea4a15be9f4a67fc528ae91
https://git.kernel.org/stable/c/2c5d2d3c3f70cde2565d7b279b544893a2035842
https://git.kernel.org/stable/c/33c0ee18cf8665c974b00f4e0ba769fbc07efe10
https://git.kernel.org/stable/c/54a62153c765cd24239cde1f2633f2a2fd005368
https://git.kernel.org/stable/c/91b40862a02000f490b63f1d315be3ee31e83871
https://git.kernel.org/stable/c/cfbd2dba3d862c9be8c92bea2a357d9ed828a54a
https://git.kernel.org/stable/c/d4fa0d544c04dea636bf821ff5582cd7d63e2c34
https://git.kernel.org/stable/c/dc11d5118f9da6ea28487ffe055de5a0d0734125
https://lore.kernel.org/linux-cve-announce/2026081555-CVE-2026-74575-34d7@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74575
https://www.cve.org/CVERecord?id=CVE-2026-74575

History

Sun, 23 Aug 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/cfbd2dba3d862c9be8c92bea2a357d9ed828a54a https://git.kernel.org/stable/c/d4fa0d544c04dea636bf821ff5582cd7d63e2c34 https://git.kernel.org/stable/c/dc11d5118f9da6ea28487ffe055de5a0d0734125

Sat, 22 Aug 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-416

Sat, 22 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://lore.kernel.org/linux-cve-announce/2026081555-CVE-2026-74575-34d7@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74575 https://www.cve.org/CVERecord?id=CVE-2026-74575
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416

Mon, 17 Aug 2026 11:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 15 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tb_xdp_handle_request() runs on system_wq and queues xd->state_work via queue_delayed_work() in three request handlers: PROPERTIES_CHANGED_REQUEST, UUID_REQUEST (via start_handshake), and LINK_STATE_CHANGE_REQUEST. Similarly, update_xdomain() queues xd->properties_changed_work when local properties change. Concurrently, tb_xdomain_remove() calls stop_handshake() which does cancel_delayed_work_sync() on both delayed works. Later, tb_xdomain_unregister() calls device_unregister() which eventually frees the xdomain. Since commit 559c1e1e0134 ("thunderbolt: Run tb_xdp_handle_request() in system workqueue") moved the request handler off tb->wq, the handler and the remove path are no longer serialized. If queue_delayed_work() executes after cancel_delayed_work_sync() but before the xdomain is freed, the delayed work fires on a freed object. Add xd->removing that tb_xdomain_remove() sets under xd->lock before calling stop_handshake(). Each external queue site holds the same lock and checks removing before calling queue_delayed_work(). This provides the mutual exclusion needed: either the queue site acquires the lock first and queues work that the subsequent cancel will see, or the remove path acquires the lock first and the queue site observes removing == true and skips the queue.
Title		thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2aa2cde2cc79a79d8ea4a15be9f4a67fc528ae91 https://git.kernel.org/stable/c/2c5d2d3c3f70cde2565d7b279b544893a2035842 https://git.kernel.org/stable/c/33c0ee18cf8665c974b00f4e0ba769fbc07efe10 https://git.kernel.org/stable/c/54a62153c765cd24239cde1f2633f2a2fd005368 https://git.kernel.org/stable/c/91b40862a02000f490b63f1d315be3ee31e83871

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T12:28:13.187Z

Updated: 2026-08-23T12:47:35.374Z

Reserved: 2026-08-15T05:44:03.917Z

Link: CVE-2026-74575

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T13:18:03.173

Modified: 2026-08-23T13:16:45.840

Link: CVE-2026-74575

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74575 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T03:45:03Z

Weaknesses

CWE-364
Signal Handler Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object