CVE-2025-40002 (GCVE-0-2025-40002)
Vulnerability from cvelistv5 – Published: 2025-10-18 08:03 – Updated: 2026-05-11 21:40
VLAI
EPSS
VEX
Title
thunderbolt: Fix use-after-free in tb_dp_dprx_work
Summary
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Fix use-after-free in tb_dp_dprx_work
The original code relies on cancel_delayed_work() in tb_dp_dprx_stop(),
which does not ensure that the delayed work item tunnel->dprx_work has
fully completed if it was already running. This leads to use-after-free
scenarios where tb_tunnel is deallocated by tb_tunnel_put(), while
tunnel->dprx_work remains active and attempts to dereference tb_tunnel
in tb_dp_dprx_work().
A typical race condition is illustrated below:
CPU 0 | CPU 1
tb_dp_tunnel_active() |
tb_deactivate_and_free_tunnel()| tb_dp_dprx_start()
tb_tunnel_deactivate() | queue_delayed_work()
tb_dp_activate() |
tb_dp_dprx_stop() | tb_dp_dprx_work() //delayed worker
cancel_delayed_work() |
tb_tunnel_put(tunnel); |
| tunnel = container_of(...); //UAF
| tunnel-> //UAF
Replacing cancel_delayed_work() with cancel_delayed_work_sync() is
not feasible as it would introduce a deadlock: both tb_dp_dprx_work()
and the cleanup path acquire tb->lock, and cancel_delayed_work_sync()
would wait indefinitely for the work item that cannot proceed.
Instead, implement proper reference counting:
- If cancel_delayed_work() returns true (work is pending), we release
the reference in the stop function.
- If it returns false (work is executing or already completed), the
reference is released in delayed work function itself.
This ensures the tb_tunnel remains valid during work item execution
while preventing memory leaks.
This bug was found by static analysis.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
d6d458d42e1e1544a18f37f1d5c840e00d5261b9 , < c07923f6a8729fc27ee652221a51702ff6654097
(git)
Affected: d6d458d42e1e1544a18f37f1d5c840e00d5261b9 , < 67600ccfc4f38ebd331b9332ac94717bfbc87ea7 (git) |
guessed | |
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.17.3 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/tunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c07923f6a8729fc27ee652221a51702ff6654097",
"status": "affected",
"version": "d6d458d42e1e1544a18f37f1d5c840e00d5261b9",
"versionType": "git"
},
{
"lessThan": "67600ccfc4f38ebd331b9332ac94717bfbc87ea7",
"status": "affected",
"version": "d6d458d42e1e1544a18f37f1d5c840e00d5261b9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/tunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.3",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Fix use-after-free in tb_dp_dprx_work\n\nThe original code relies on cancel_delayed_work() in tb_dp_dprx_stop(),\nwhich does not ensure that the delayed work item tunnel-\u003edprx_work has\nfully completed if it was already running. This leads to use-after-free\nscenarios where tb_tunnel is deallocated by tb_tunnel_put(), while\ntunnel-\u003edprx_work remains active and attempts to dereference tb_tunnel\nin tb_dp_dprx_work().\n\nA typical race condition is illustrated below:\n\nCPU 0 | CPU 1\ntb_dp_tunnel_active() |\n tb_deactivate_and_free_tunnel()| tb_dp_dprx_start()\n tb_tunnel_deactivate() | queue_delayed_work()\n tb_dp_activate() |\n tb_dp_dprx_stop() | tb_dp_dprx_work() //delayed worker\n cancel_delayed_work() |\n tb_tunnel_put(tunnel); |\n | tunnel = container_of(...); //UAF\n | tunnel-\u003e //UAF\n\nReplacing cancel_delayed_work() with cancel_delayed_work_sync() is\nnot feasible as it would introduce a deadlock: both tb_dp_dprx_work()\nand the cleanup path acquire tb-\u003elock, and cancel_delayed_work_sync()\nwould wait indefinitely for the work item that cannot proceed.\n\nInstead, implement proper reference counting:\n- If cancel_delayed_work() returns true (work is pending), we release\n the reference in the stop function.\n- If it returns false (work is executing or already completed), the\n reference is released in delayed work function itself.\n\nThis ensures the tb_tunnel remains valid during work item execution\nwhile preventing memory leaks.\n\nThis bug was found by static analysis."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T21:40:34.575Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c07923f6a8729fc27ee652221a51702ff6654097"
},
{
"url": "https://git.kernel.org/stable/c/67600ccfc4f38ebd331b9332ac94717bfbc87ea7"
}
],
"title": "thunderbolt: Fix use-after-free in tb_dp_dprx_work",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40002",
"datePublished": "2025-10-18T08:03:22.718Z",
"dateReserved": "2025-04-16T07:20:57.151Z",
"dateUpdated": "2026-05-11T21:40:34.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-40002",
"date": "2026-10-22",
"epss": "0.00253",
"percentile": "0.15818"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/tunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c07923f6a8729fc27ee652221a51702ff6654097",
"status": "affected",
"version": "d6d458d42e1e1544a18f37f1d5c840e00d5261b9",
"versionType": "git"
},
{
"lessThan": "67600ccfc4f38ebd331b9332ac94717bfbc87ea7",
"status": "affected",
"version": "d6d458d42e1e1544a18f37f1d5c840e00d5261b9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/tunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Fix use-after-free in tb_dp_dprx_work\n\nThe original code relies on cancel_delayed_work() in tb_dp_dprx_stop(),\nwhich does not ensure that the delayed work item tunnel-\u003edprx_work has\nfully completed if it was already running. This leads to use-after-free\nscenarios where tb_tunnel is deallocated by tb_tunnel_put(), while\ntunnel-\u003edprx_work remains active and attempts to dereference tb_tunnel\nin tb_dp_dprx_work().\n\nA typical race condition is illustrated below:\n\nCPU 0 | CPU 1\ntb_dp_tunnel_active() |\n tb_deactivate_and_free_tunnel()| tb_dp_dprx_start()\n tb_tunnel_deactivate() | queue_delayed_work()\n tb_dp_activate() |\n tb_dp_dprx_stop() | tb_dp_dprx_work() //delayed worker\n cancel_delayed_work() |\n tb_tunnel_put(tunnel); |\n | tunnel = container_of(...); //UAF\n | tunnel-\u003e //UAF\n\nReplacing cancel_delayed_work() with cancel_delayed_work_sync() is\nnot feasible as it would introduce a deadlock: both tb_dp_dprx_work()\nand the cleanup path acquire tb-\u003elock, and cancel_delayed_work_sync()\nwould wait indefinitely for the work item that cannot proceed.\n\nInstead, implement proper reference counting:\n- If cancel_delayed_work() returns true (work is pending), we release\n the reference in the stop function.\n- If it returns false (work is executing or already completed), the\n reference is released in delayed work function itself.\n\nThis ensures the tb_tunnel remains valid during work item execution\nwhile preventing memory leaks.\n\nThis bug was found by static analysis."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nthunderbolt: Soluciona uso despu\u00e9s de liberaci\u00f3n en tb_dp_dprx_work\n\nEl c\u00f3digo original se basa en cancel_delayed_work() en tb_dp_dprx_stop(), lo que no asegura que el elemento de trabajo retrasado tunnel-\u003edprx_work haya completado completamente si ya estaba en ejecuci\u00f3n. Esto lleva a escenarios de uso despu\u00e9s de liberaci\u00f3n donde tb_tunnel es desasignado por tb_tunnel_put(), mientras que tunnel-\u003edprx_work permanece activo e intenta desreferenciar tb_tunnel en tb_dp_dprx_work().\n\nUna condici\u00f3n de carrera t\u00edpica se ilustra a continuaci\u00f3n:\n\nCPU 0 | CPU 1\ntb_dp_tunnel_active() |\n tb_deactivate_and_free_tunnel()| tb_dp_dprx_start()\n tb_tunnel_deactivate() | queue_delayed_work()\n tb_dp_activate() |\n tb_dp_dprx_stop() | tb_dp_dprx_work() //trabajador retrasado\n cancel_delayed_work() |\n tb_tunnel_put(tunnel); |\n | tunnel = container_of(...); //UAF\n | tunnel-\u003e //UAF\n\nReemplazar cancel_delayed_work() con cancel_delayed_work_sync() no es factible ya que introducir\u00eda un interbloqueo: tanto tb_dp_dprx_work() como la ruta de limpieza adquieren tb-\u003elock, y cancel_delayed_work_sync() esperar\u00eda indefinidamente por el elemento de trabajo que no puede continuar.\n\nEn su lugar, implementa un conteo de referencias adecuado:\n- Si cancel_delayed_work() devuelve verdadero (el trabajo est\u00e1 pendiente), liberamos la referencia en la funci\u00f3n de parada.\n- Si devuelve falso (el trabajo se est\u00e1 ejecutando o ya ha completado), la referencia se libera en la propia funci\u00f3n de trabajo retrasado.\n\nEsto asegura que el tb_tunnel permanezca v\u00e1lido durante la ejecuci\u00f3n del elemento de trabajo mientras previene fugas de memoria.\n\nEste error fue encontrado mediante an\u00e1lisis est\u00e1tico."
}
],
"id": "CVE-2025-40002",
"lastModified": "2026-10-19T21:10:00.160",
"metrics": {},
"published": "2025-10-18T08:15:34.243",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/67600ccfc4f38ebd331b9332ac94717bfbc87ea7"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/c07923f6a8729fc27ee652221a51702ff6654097"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Deferred"
}
},
"redhat_vex": {
"aggregate_severity": "None",
"current_release_date": "2026-06-30T10:24:12+00:00",
"cve": "CVE-2025-40002",
"id": "CVE-2025-40002",
"initial_release_date": "2025-10-18T00:00:00+00:00",
"product_status:known_not_affected": "274",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: thunderbolt: Fix use-after-free in tb_dp_dprx_work",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40002.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.