A bug in the Thunderbolt XDP properties request handler causes the driver to copy data from a peer without checking that the per‑packet length fits within the buffer previously allocated. The resulting memcpy operation can overwrite memory beyond the allocated region, corrupting kernel data structures or executing arbitrary code. This is a classic out‑of‑bounds write vulnerability.

The flaw resides in the Linux kernel’s Thunderbolt subsystem. No specific kernel releases are listed in the CVE record, so affected systems are those running any Linux kernel version that contains the vulnerable tb_xdp_properties_request implementation before the patch commits cited in the advisory.

The EPSS score is missing and the vulnerability is not in the CISA KEV catalog, but the lack of bounds checking implies a high severity. The likely attack vector is a malicious Thunderbolt device that can send crafted packets to the host; this is inferred from the nature of the driver. If an attacker can supply such data, they could cause memory corruption that leads to privilege escalation or denial of service.