In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Do not double dequeue a configuration request
Some of our devices crash in tbcfgrequest_dequeue():
general protection fault, probably for non-canonical address 0xdead000000000122
CPU: 6 PID: 91007 Comm: kworker/6:2 Tainted: G U W 6.6.65 RIP: 0010:tbcfgrequestdequeue+0x2d/0xa0 Call Trace: <TASK> ? tbcfgrequestdequeue+0x2d/0xa0 tbcfgrequestwork+0x33/0x80 workerthread+0x386/0x8f0 kthread+0xed/0x110 retfromfork+0x38/0x50 retfromfork_asm+0x1b/0x30
The circumstances are unclear, however, the theory is that tbcfgrequestwork() can be scheduled twice for a request: first time via frame.callback from ringwork() and second time from tbcfgrequest(). Both times kworkers will execute tbcfgrequestdequeue(), which results in double listdel() from the ctl->request_queue (the list poison deference hints at it: 0xdead000000000122).
Do not dequeue requests that don't have TBCFGREQUEST_ACTIVE bit set.
[
{
"target": {
"function": "tb_cfg_request_dequeue",
"file": "drivers/thunderbolt/ctl.c"
},
"signature_version": "v1",
"digest": {
"length": 353.0,
"function_hash": "139206311040004804619032570925031790909"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a057f261539720165d03d85024da2b52e67f63d",
"deprecated": false,
"id": "CVE-2025-38174-0f6b8ff7",
"signature_type": "Function"
},
{
"target": {
"file": "drivers/thunderbolt/ctl.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"284904353808301822919651305176605910507",
"330756736690010763547091951294243108629",
"106019531580557290635139732084344943063",
"333494747490081645155585366359633746013"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f62eda4d974c26bc595425eafd429067541f2c9",
"deprecated": false,
"id": "CVE-2025-38174-46f7b15b",
"signature_type": "Line"
},
{
"target": {
"file": "drivers/thunderbolt/ctl.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"284904353808301822919651305176605910507",
"330756736690010763547091951294243108629",
"106019531580557290635139732084344943063",
"333494747490081645155585366359633746013"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a057f261539720165d03d85024da2b52e67f63d",
"deprecated": false,
"id": "CVE-2025-38174-498f0368",
"signature_type": "Line"
},
{
"target": {
"file": "drivers/thunderbolt/ctl.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"284904353808301822919651305176605910507",
"330756736690010763547091951294243108629",
"106019531580557290635139732084344943063",
"333494747490081645155585366359633746013"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e49e994cd83705f7ca30eda1e304abddfd96a37a",
"deprecated": false,
"id": "CVE-2025-38174-53bc755e",
"signature_type": "Line"
},
{
"target": {
"file": "drivers/thunderbolt/ctl.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"284904353808301822919651305176605910507",
"330756736690010763547091951294243108629",
"106019531580557290635139732084344943063",
"333494747490081645155585366359633746013"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb2d5e794fb966b3ef8bde99eb8561446a53509f",
"deprecated": false,
"id": "CVE-2025-38174-6870a2da",
"signature_type": "Line"
},
{
"target": {
"function": "tb_cfg_request_dequeue",
"file": "drivers/thunderbolt/ctl.c"
},
"signature_version": "v1",
"digest": {
"length": 353.0,
"function_hash": "139206311040004804619032570925031790909"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e49e994cd83705f7ca30eda1e304abddfd96a37a",
"deprecated": false,
"id": "CVE-2025-38174-9082907e",
"signature_type": "Function"
},
{
"target": {
"function": "tb_cfg_request_dequeue",
"file": "drivers/thunderbolt/ctl.c"
},
"signature_version": "v1",
"digest": {
"length": 353.0,
"function_hash": "139206311040004804619032570925031790909"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f62eda4d974c26bc595425eafd429067541f2c9",
"deprecated": false,
"id": "CVE-2025-38174-b4f82ca4",
"signature_type": "Function"
},
{
"target": {
"function": "tb_cfg_request_dequeue",
"file": "drivers/thunderbolt/ctl.c"
},
"signature_version": "v1",
"digest": {
"length": 353.0,
"function_hash": "139206311040004804619032570925031790909"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb2d5e794fb966b3ef8bde99eb8561446a53509f",
"deprecated": false,
"id": "CVE-2025-38174-d9f58867",
"signature_type": "Function"
}
]