CVE-2026-74575

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Prevent XDomain delayed work use-after-free on disconnect

tbxdphandlerequest() runs on systemwq and queues xd->statework via queuedelayedwork() in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST (via starthandshake), and LINKSTATECHANGEREQUEST. Similarly, updatexdomain() queues xd->propertieschanged_work when local properties change.

Concurrently, tbxdomainremove() calls stophandshake() which does canceldelayedworksync() on both delayed works. Later, tbxdomainunregister() calls deviceunregister() which eventually frees the xdomain. Since commit 559c1e1e0134 ("thunderbolt: Run tbxdphandlerequest() in system workqueue") moved the request handler off tb->wq, the handler and the remove path are no longer serialized. If queuedelayedwork() executes after canceldelayedwork_sync() but before the xdomain is freed, the delayed work fires on a freed object.

Add xd->removing that tbxdomainremove() sets under xd->lock before calling stophandshake(). Each external queue site holds the same lock and checks removing before calling queuedelayed_work(). This provides the mutual exclusion needed: either the queue site acquires the lock first and queues work that the subsequent cancel will see, or the remove path acquires the lock first and the queue site observes removing == true and skips the queue.