Key Information Vulnerability Type: Use-after-free (UAF) Affected Function: Issue Description: - Original code calls in , which does not guarantee that the delayed work item has fully completed. - If is still running when releases the tunnel, a UAF condition occurs. Race Condition Example: Solution: - Implement proper reference counting: - If returns true (work is pending), release the reference in the stop function. - If it returns false (work is running or completed), release the reference within the delayed work function itself. Discovery Method: Static analysis Fix Commit: d6d458d42e1e ("thunderbolt: Handle DisplayPort tunnel activation asynchronously")