The kernel’s Thunderbolt driver contains a flaw where the tb_xdomain_copy() function copies response bytes based on the requested response size without verifying that this size does not exceed the actual frame size. When a short response is received, the function reads past the valid data area into stale contents from previous DMA transactions. This results in an out‑of‑bounds memory read (CWE‑125) that can leak kernel data to an attacker. The vulnerability does not allow direct code execution; its primary risk is the disclosure of privileged kernel information if an attacker can trigger the XDomain response copy.

The issue is present in every Linux kernel build that ships the Thunderbolt driver until the kernel incorporates the fix that limits the copy length to the smaller of the frame size and the expected response size. No specific kernel version thresholds are enumerated, so all current releases are potentially vulnerable unless the patch is applied.

Because the flaw requires interacting with an XDomain response, exploitation demands either local or elevated privileges that allow a user to send carefully crafted packets to a Thunderbolt device. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the risk becomes appreciable on systems where untrusted users have the ability to communicate with Thunderbolt endpoints, though the lack of remote execution and the need for privileged access means the potential for widespread impact is limited.