CVE-2026-74575

A flaw was found in the Thunderbolt XDomain driver of the Linux kernel. A race condition can occur during the removal of a Thunderbolt cross-domain device (XDomain). This allows a delayed work item to be queued after its cancellation but before the XDomain object is freed, leading to a use-after-free vulnerability. This issue could result in system instability or a denial of service (DoS).

Thunderbolt XDomain delayed work can be queued after tb_xdomain_remove has already canceled pending work but before device_unregister frees the xdomain object. A remote peer on the Thunderbolt/USB4 link can send XDomain requests such as PROPERTIES_CHANGED_REQUEST, UUID_REQUEST, or LINK_STATE_CHANGE_REQUEST while disconnect handling is running, creating a race where state_work or properties_changed_work later runs on freed memory. For the CVSS the PR:N is used because the attacker does not need a local account or privileges on the victim host, but does need access to a connected Thunderbolt/USB4 peer or device path. The issue is not Internet network reachable and is best treated as physical or adjacent bus reachable. Impact is at least denial of service via kernel crash. Because this is a real use after free in kernel delayed work, worst case confidentiality and integrity impact are plausible and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.