CVE-2025-38174

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Do not double dequeue a configuration request

Some of our devices crash in tb_cfg_request_dequeue():

general protection fault, probably for non-canonical address 0xdead000000000122

CPU: 6 PID: 91007 Comm: kworker/6:2 Tainted: G U W 6.6.65

RIP: 0010:tb_cfg_request_dequeue+0x2d/0xa0

Call Trace:

<TASK>

? tb_cfg_request_dequeue+0x2d/0xa0

tb_cfg_request_work+0x33/0x80

worker_thread+0x386/0x8f0

kthread+0xed/0x110

ret_from_fork+0x38/0x50

ret_from_fork_asm+0x1b/0x30

The circumstances are unclear, however, the theory is that

tb_cfg_request_work() can be scheduled twice for a request:

first time via frame.callback from ring_work() and second

time from tb_cfg_request(). Both times kworkers will execute

tb_cfg_request_dequeue(), which results in double list_del()

from the ctl->request_queue (the list poison deference hints

at it: 0xdead000000000122).

Do not dequeue requests that don't have TB_CFG_REQ

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References