Vulnerability in Linux Kernel Affecting Thunderbolt Configuration Requests

CVE-2025-38174

What is CVE-2025-38174?

A fault in the Linux kernel's handling of Thunderbolt configuration requests has been identified, specifically in the tb_cfg_request_dequeue function. This vulnerability arises when requests are inadvertently dequeued multiple times, leading to system instability and potential crashes due to non-canonical addresses. The issue occurs when tb_cfg_request_work is scheduled more than once for the same request, compromising the integrity of the request queue and ultimately resulting in general protection faults. Mitigation efforts involve ensuring that requests lacking the TB_CFG_REQUEST_ACTIVE bit are not dequeued, thereby preventing double processing and enhancing overall system reliability.

References