Security readout for executives and security teams
Plain-English summary
A Linux Thunderbolt request-handling flaw can remove the same queued request twice, corrupting kernel state and crashing the system. The supplied severity is high, with CVSS 8.8. The source directly documents crashes; broader confidentiality or integrity impact is assessed by the CVSS vector but not demonstrated in the description.
Executive priority
Treat as an expedited kernel-maintenance issue for Thunderbolt-capable systems, especially operationally critical endpoints. It does not currently warrant an exploitation-driven emergency response because active exploitation is unsupported, but the documented kernel crash creates meaningful availability risk.
Technical view
Two worker paths may schedule the same configuration request and both call tb_cfg_request_dequeue(), causing a double list deletion and poisoned-pointer dereference. The kernel fix prevents dequeueing unless TB_CFG_REQUEST_ACTIVE is set. The triggering circumstances remain unclear.
Likely exposure
Exposure is concentrated on systems running affected Linux kernel branches with the Thunderbolt subsystem and relevant devices. The bundle spans multiple kernel versions but does not provide sufficient distribution-package mapping; administrators should verify exact exposure through their Linux vendor.
Exploitation context
The supplied CVSS vector requires adjacent access but no privileges or user interaction. CISA KEV status is false, and the sources provide no evidence of active exploitation or a public exploit. Reliable triggering is uncertain because the reported circumstances were unclear.
Researcher notes
The proposed root cause is duplicate scheduling through frame.callback and tb_cfg_request(), followed by two dequeue operations. The poisoned address supports a double-list-deletion theory. Sources do not establish deterministic reproduction, attacker control, privilege escalation, or exploitation beyond the observed kernel crash.
Mitigation direction
- Install a vendor kernel update containing the referenced Linux stable fix.
- Reboot affected systems so the corrected kernel is actually running.
- Prioritize systems using Thunderbolt hardware or exposing Thunderbolt connectivity.
- Consult distribution guidance when package-to-kernel commit mapping is uncertain.
Validation and detection
- Inventory running kernel versions and identify systems using the Thunderbolt subsystem.
- Compare installed vendor packages with advisories covering CVE-2025-38174.
- Confirm the running kernel contains the active-request dequeue guard after reboot.
- Review kernel logs for tb_cfg_request_dequeue faults, list poisoning, or related kworker crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38174 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e49e994cd83705f7ca30eda1e304abddfd96a37aCVE reference, Linux
- https://git.kernel.org/stable/c/0a3011d47dbc92a33621861c423cb64833d7fe57CVE reference, Linux
- https://git.kernel.org/stable/c/2f62eda4d974c26bc595425eafd429067541f2c9CVE reference, Linux
- https://git.kernel.org/stable/c/85286e634ebbaf9c0fb1cdf580add2f33fc7628cCVE reference, Linux
- https://git.kernel.org/stable/c/5a057f261539720165d03d85024da2b52e67f63dCVE reference, Linux
- https://git.kernel.org/stable/c/eb2d5e794fb966b3ef8bde99eb8561446a53509fCVE reference, Linux
- https://git.kernel.org/stable/c/0771bcbe2f6e5d5f263cf466efe571d2754a46daCVE reference, Linux
- https://git.kernel.org/stable/c/cdb4feab2f39e75a66239e3a112beced279612a8CVE reference, Linux
- https://git.kernel.org/stable/c/0f73628e9da1ee39daf5f188190cdbaee5e0c98cCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.