thunderbolt XDomain UAF

Vulnerability analysis

When a Thunderbolt XDomain service is created, the code associates it with its parent XDomain device without holding a reference on that parent. Later, when the service is destroyed, its cleanup routine accesses the parent XDomain's internal ID allocation data to release the service's ID. If the XDomain has already been torn down—for instance when a Thunderbolt device is disconnected—the cleanup code operates on freed memory. The fix takes a reference on the XDomain device when the service is created and releases it only when the service is fully destroyed, guaranteeing the parent remains valid throughout the service's lifetime. This path is reached through physical access to a Thunderbolt or USB4 port; no software privileges are required, only the ability to connect and disconnect a Thunderbolt device.