Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep XDomain reference during the lifetime of a service This is needed because we release the service ID in tb_service_release() and the ID array is owned by the parent XDomain.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-24T17:17:28.767Z",
  "pubdate": "2026-09-24T17:17:28.767Z",
  "executiveSummary": "This vulnerability involves a use-after-free condition within the Linux kernel's Thunderbolt subsystem related to XDomain service management.\nThe flaw stems from an improper lifecycle management of XDomain references, specifically how service IDs are handled relative to their parent objects.\nBecause the service ID is released in tb_service_release() while remaining reliant on an array owned by the parent XDomain, an attacker could potentially trigger a situation where the kernel references memory that has been deallocated or modified.\nThis can lead to kernel memory corruption, system instability, or potential arbitrary code execution if the reference can be manipulated by an attacker to point to controlled data.\nThe vulnerability affects the Linux kernel Thunderbolt driver, specifically components managing XDomain service objects.\nThe risk is primarily relevant in environments where malicious Thunderbolt devices could be connected to the host system.\nExploitation requires the ability to interact with the Thunderbolt interface, typically necessitating physical access or a malicious device masquerading as a peripheral.",
  "technicalDetails": "The root cause of this vulnerability lies in an object lifetime mismatch between the Thunderbolt XDomain service objects and their parent XDomain structures.\nIn the Linux kernel's Thunderbolt implementation, tb_service_release() is responsible for cleaning up service objects. However, these services rely on an ID array that resides within the parent XDomain object.\nPrior to the fix, the kernel failed to maintain a persistent reference to the parent XDomain for the entire duration of the service's lifetime. When the service was released, the reference count management did not sufficiently protect the parent structure from premature deallocation or invalid access if the service reference persisted beyond the parent's lifecycle.\nThe attack flow proceeds as follows: An attacker with physical access to the Thunderbolt port connects a specially crafted malicious device. This device initializes XDomain communication. The attacker triggers a series of service discovery and teardown requests that manipulate the reference counting of the XDomain services.\nBy inducing the kernel to call tb_service_release() while the parent XDomain object is being destroyed or subjected to concurrent modification, an attacker creates a race condition.\nBecause the service ID array is owned by the parent XDomain, subsequent accesses to this array occur after the parent has either been freed (Use-After-Free) or is in an inconsistent state.\nThis results in a kernel oops, memory corruption, or potentially hijacking control flow if the freed memory is reallocated by the kernel allocator to hold other sensitive structures that the attacker can then influence.\nThe vulnerable component is identified within the Thunderbolt subsystem's XDomain service handling logic. As this involves kernel-space memory management, successful exploitation grants the attacker ring-0 privileges.\nThe complexity of this exploit is high, as it requires precise timing and manipulation of the Thunderbolt device discovery protocol, but the impact is critical, as it bypasses standard kernel memory protections through logic-based lifecycle mismanagement.\nThis issue highlights a deficiency in the reference counting chain between child service objects and their parent infrastructure within the Thunderbolt XDomain subsystem."
}