This CVE demonstrates a subtle but critical failure mode: refactoring that changes workqueue assignment can silently destroy implicit synchronization between request handlers and removal paths, converting latent safety into an exploitable race condition.
The vulnerability originated in commit 559c1e1e0134, which migrated Thunderbolt request handlers from a dedicated workqueue (tb->wq) to the system workqueue. The dedicated queue wasn't just a scheduling mechanism—it enforced mutual exclusion between the request handlers and tb_xdomain_remove() through workqueue topology. As long as both paths shared tb->wq, they were mutually exclusive by construction. Moving handlers to system_wq broke this invariant without any code indicating the synchronization assumption was being altered.
The fix introduces an explicit 'removing' flag protected by xd->lock, forcing every queue site to check this flag before queuing work. While technically correct, this pattern is architecturally fragile: it replaces implicit serialization (enforced by the scheduler) with explicit state management that depends on disciplined flag checking at every queue site. Future developers adding new request handlers must remember to check and set this flag under the lock—a review burden that didn't exist before.
For defenders: audit your codebases for workqueue topology changes, particularly commits that migrate handlers from dedicated to shared queues. When such changes occur, trace all teardown and removal paths that might share implicit serialization with the queued work. The absence of explicit synchronization documentation in the original commit is the red flag—this refactoring was treated as a performance tweak, not a synchronization change.
The systemic risk extends beyond this CVE. Many kernel subsystems rely on workqueue topology as an implicit serialization barrier. Treat any workqueue assignment change as a potential security-adjacent review trigger, similar to how timer changes are scrutinized. Document synchronization invariants in commit messages when moving queue sites—future maintainers cannot infer what the scheduler was doing for free.