CVE-2026-74575

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the thunderbolt component. The function tb xdp handle request() runs on the system workqueue and queues xd->state work via queue delayed work() during specific request handlers: PROPERTIES CHANGED REQUEST, UUID REQUEST (via start handshake()), and LINK STATE CHANGE REQUEST. Additionally, update xdomain() queues xd->properties changed work when local properties change. Simultaneously, tb xdomain remove() invokes stop handshake(), which performs cancel delayed work sync() on these delayed works, and tb xdomain unregister() eventually frees the xdomain. Because the request handler and the remove path are no longer serialized, queue delayed work() may execute after cancel delayed work sync() but before the xdomain is freed, causing the delayed work to execute on a freed object.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.