CVE ID : CVE-2025-40002<\/p>\n
Published : Oct. 18, 2025, 8:15 a.m. | 25\u00a0minutes ago<\/p>\n
Description : In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
thunderbolt: Fix use-after-free in tb_dp_dprx_work<\/p>\n
The original code relies on cancel_delayed_work() in tb_dp_dprx_stop(),
\nwhich does not ensure that the delayed work item tunnel->dprx_work has
\nfully completed if it was already running. This leads to use-after-free
\nscenarios where tb_tunnel is deallocated by tb_tunnel_put(), while
\ntunnel->dprx_work remains active and attempts to dereference tb_tunnel
\nin tb_dp_dprx_work().<\/p>\n
A typical race condition is illustrated below:<\/p>\n
CPU 0 | CPU 1
\ntb_dp_tunnel_active() |
\n tb_deactivate_and_free_tunnel()| tb_dp_dprx_start()
\n tb_tunnel_deactivate() | queue_delayed_work()
\n tb_dp_activate() |
\n tb_dp_dprx_stop() | tb_dp_dprx_work() \/\/delayed worker
\n cancel_delayed_work() |
\n tb_tunnel_put(tunnel); |
\n | tunnel = container_of(…); \/\/UAF
\n | tunnel-> \/\/UAF<\/p>\n
Replacing cancel_delayed_work() with cancel_delayed_work_sync() is
\nnot feasible as it would introduce a deadlock: both tb_dp_dprx_work()
\nand the cleanup path acquire tb->lock, and cancel_delayed_work_sync()
\nwould wait indefinitely for the work item that cannot proceed.<\/p>\n
Instead, implement proper reference counting:
\n– If cancel_delayed_work() returns true (work is pending), we release
\n the reference in the stop function.
\n– If it returns false (work is executing or already completed), the
\n reference is released in delayed work function itself.<\/p>\n
This ensures the tb_tunnel remains valid during work item execution
\nwhile preventing memory leaks.<\/p>\n
This bug was found by static analysis.<\/p>\n
Severity: 0.0 | NA<\/p>\n
Visit the link for more details, such as CVSS details, affected products, timeline, and more…\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
CVE ID : CVE-2025-40002 Published : Oct. 18, 2025, 8:15 a.m. | 25\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix use-after-free in tb_dp_dprx_work The original code relies on cancel_delayed_work() in tb_dp_dprx_stop(), which does not ensure that the delayed work item tunnel->dprx_work has fully completed if it was …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-71950","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/71950","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=71950"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/71950\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=71950"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=71950"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=71950"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}