CVE-2025-38174: thunderbolt: Do not double dequeue a configuration request
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Do not double dequeue a configuration request
Some of our devices crash in tbcfgrequestdequeue():
general protection fault, probably for non-canonical address 0xdead000000000122
CPU: 6 PID: 91007 Comm: kworker/6:2 Tainted: G U W 6.6.65 RIP: 0010:tbcfgrequestdequeue+0x2d/0xa0 Call Trace: <TASK> ? tbcfgrequestdequeue+0x2d/0xa0 tbcfgrequestwork+0x33/0x80 workerthread+0x386/0x8f0 kthread+0xed/0x110 retfromfork+0x38/0x50 retfromforkasm+0x1b/0x30
The circumstances are unclear, however, the theory is that tbcfgrequestwork() can be scheduled twice for a request: first time via frame.callback from ringwork() and second time from tbcfgrequest(). Both times kworkers will execute tbcfgrequestdequeue(), which results in double listdel() from the ctl->requestqueue (the list poison deference hints at it: 0xdead000000000122).
Do not dequeue requests that don't have TBCFGREQUESTACTIVE bit set.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38174?
CVE-2025-38174 has a severity rating of medium due to the potential for device crashes and general protection faults.
How do I fix CVE-2025-38174?
To fix CVE-2025-38174, users should update their Linux kernel to the latest stable release where this vulnerability is addressed.
What systems are affected by CVE-2025-38174?
CVE-2025-38174 affects devices running specific versions of the Linux kernel that utilize Thunderbolt technology.
What are the potential impacts of CVE-2025-38174?
The potential impacts of CVE-2025-38174 include system crashes and instability resulting from configuration request handling issues.
When was CVE-2025-38174 disclosed?
CVE-2025-38174 was disclosed as part of a vulnerability report addressing issues in the Linux kernel related to Thunderbolt.