# CVE-2025-40002: linux: In the Linux kernel, the following vulnerability has been resolved:  thunderbolt: Fix use-after-free in tb_dp_dprx_wo...

CVE-2025-40002 is fixed in linux on 1 platform by DEBIAN-CVE-2025-40002 (version 6.17.6-1), released October 18, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2025-40002
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0025
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 18, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  thunderbolt: Fix use-after-free in tb_dp_dprx_work  The original code relies on cancel_delayed_work() in tb_dp_dprx_stop(), which does not ensure that the delayed work item tunnel->dprx_work has fully completed if it was already running. This leads to use-after-free scenarios where tb_tunnel is deallocated by tb_tunnel_put(), while tunnel->dprx_work remains active and attempts to dereference tb_tunnel in tb_dp_dprx_work().  A typical race condition is illustrated below:  CPU 0                            | CPU 1 tb_dp_tunnel_active()            |   tb_deactivate_and_free_tunnel()| tb_dp_dprx_start()     tb_tunnel_deactivate()       |   queue_delayed_work()       tb_dp_activate()           |         tb_dp_dprx_stop()        | tb_dp_dprx_work() //delayed worker           cancel_delayed_work()  |     tb_tunnel_put(tunnel);       |                                  |   tunnel = container_of(...); //UAF                                  |   tunnel-> //UAF  Replacing cancel_delayed_work() with cancel_delayed_work_sync() is not feasible as it would introduce a deadlock: both tb_dp_dprx_work() and the cleanup path acquire tb->lock, and cancel_delayed_work_sync() would wait indefinitely for the work item that cannot proceed.  Instead, implement proper reference counting: - If cancel_delayed_work() returns true (work is pending), we release   the reference in the stop function. - If it returns false (work is executing or already completed), the   reference is released in delayed work function itself.  This ensures the tb_tunnel remains valid during work item execution while preventing memory leaks.  This bug was found by static analysis.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 6.17.6-1 | [DEBIAN-CVE-2025-40002](https://patchblox.com/security/data/fix/linux/debian-cve-2025-40002.md) | Oct 18, 2025 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.