Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Set tb->root_switch to NULL when domain is stopped Similarly what we do with the firmware connection manager. This makes tb_xdp_handle_request() return error to the remote host. However, we need to make sure we keep the uuid alive so that we can reply until the whole domain is released.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-24T17:17:28.650Z",
  "pubdate": "2026-09-24T17:17:28.650Z",
  "executiveSummary": "This vulnerability involves a potential state inconsistency within the Linux kernel Thunderbolt subsystem during domain teardown.\nThe issue is characterized by improper management of the root_switch pointer when a Thunderbolt domain is stopped.\nFailure to nullify the root_switch pointer while the domain remains active allows the tb_xdp_handle_request() function to process requests against an invalid or partially released state.\nThis represents a logic flaw that could lead to memory corruption or undefined kernel behavior when handling remote host requests.\nThe vulnerability affects Linux kernel systems utilizing Thunderbolt connectivity.\nAn attacker with physical access to a Thunderbolt port could potentially trigger this race condition or state mismatch, leading to system instability or arbitrary memory interaction.\nSuccessful exploitation requires the timing of a domain stop operation to coincide with a malicious or specifically crafted request from a connected peripheral or remote host.",
  "technicalDetails": "The root cause of this vulnerability lies in the race condition between the domain teardown process and the request handling logic in the Thunderbolt subsystem.\nSpecifically, when a Thunderbolt domain is stopped, the tb->root_switch pointer is not explicitly set to NULL. In the previous implementation, the system lacked a synchronization mechanism to ensure that the request handler, tb_xdp_handle_request(), would reject incoming XDP requests once the domain entered a shutdown state.\nWhen tb_xdp_handle_request() is invoked, it relies on the integrity of the root_switch object. If the domain is in the process of stopping, but the pointer remains populated, the function attempts to process requests using a stale or invalid object, resulting in a use-after-free or a null pointer dereference depending on the internal state of the domain memory structures.\nThe patch addresses this by enforcing the nullification of tb->root_switch upon domain stoppage, mirroring the protective logic previously established for the firmware connection manager.\nHowever, a critical requirement for maintaining system stability is ensuring that the UUID associated with the domain remains persistent throughout the entire lifecycle of the domain release. This prevents premature deallocation of identifiers that are required to construct valid responses to remote hosts until the domain resource cleanup is complete.\nThe attack flow involves: 1) The host kernel initiates a domain stop sequence. 2) Before the domain is fully released, a malicious device or actor sends a specially crafted XDP request. 3) The tb_xdp_handle_request() function executes, finding the non-NULL root_switch pointer. 4) The function processes the request using invalid context, leading to a kernel crash or potential code execution depending on memory layout. 5) By ensuring tb->root_switch is set to NULL immediately upon domain stop, the kernel forces the handler to return an error, effectively mitigating the illegal memory access.\nThis vulnerability resides in the Thunderbolt subsystem's handling of domain lifecycle events and request processing, specifically impacting the interaction between host-to-peripheral communication and internal state management."
}