CVE-2026-74575: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-74575 is a use-after-free vulnerability in the Linux kernel's Thunderbolt XDomain implementation that can allow a local attacker to trigger kernel crashes or execute arbitrary code with kernel privileges. The flaw was introduced after commit 559c1e1e0134 moved tb_xdp_handle_request() to the system workqueue, decoupling it from the serialized tb->wq path. Affected kernel versions begin at 5.2; fixed versions include 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc1. The vulnerability was published on August 15, 2026, with a patch available the same day. CVSS scoring is estimated as Medium severity (GitHub Advisory, Feedly).

The root cause is a race condition leading to a use-after-free (CWE-416) in the Thunderbolt XDomain subsystem. tb_xdp_handle_request() runs on system_wq and queues xd->state_work via queue_delayed_work() for PROPERTIES_CHANGED_REQUEST, UUID_REQUEST, and LINK_STATE_CHANGE_REQUEST handlers; update_xdomain() similarly queues xd->properties_changed_work. Concurrently, tb_xdomain_remove() calls stop_handshake() which invokes cancel_delayed_work_sync() on both works, then tb_xdomain_unregister() frees the xdomain object. If queue_delayed_work() executes after cancel_delayed_work_sync() but before the object is freed, the delayed work callback fires on a freed xdomain object. The fix introduces an xd->removing flag set under xd->lock before stop_handshake() is called; all queue_delayed_work() call sites must hold the same lock and check this flag before queuing (GitHub Advisory).

Successful exploitation allows a local user with the ability to trigger Thunderbolt XDomain disconnection events to cause a use-after-free condition in kernel memory, potentially resulting in arbitrary code execution with kernel privileges or a kernel panic (denial of service). Because exploitation occurs at the kernel level, a successful attack could fully compromise the affected system, bypass security boundaries, and enable privilege escalation from a local user to root. The scope is limited to systems with Thunderbolt hardware and kernel versions from 5.2 up to the patched releases (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires local access and the ability to trigger Thunderbolt XDomain disconnect events, limiting the attack surface. No threat actor attribution has been reported. The EPSS score is 0.0 and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Nessus plugin 335861 has been released to detect affected systems (Tenable).

Update the Linux kernel to a patched version: 6.6.151 or later (6.6.x branch), 6.12.103 or later (6.12.x branch), 6.18.44 or later (6.18.x branch), 7.1.8 or later (7.1.x branch), or 7.2-rc1 and later. As a workaround where patching is not immediately possible, restrict physical and logical access to Thunderbolt ports and limit which users can interact with Thunderbolt XDomain devices. Disabling Thunderbolt support in the kernel configuration or BIOS/UEFI can also eliminate the attack surface on systems where Thunderbolt is not required (GitHub Advisory, Feedly).

The vulnerability received routine coverage from CVE aggregation and vulnerability database services shortly after disclosure. A Reddit post in the r/pwnhub community included it in a daily CVE brief on August 16, 2026. No notable researcher commentary or vendor statements beyond the kernel patch itself have been identified (Feedly).