The vulnerability resides in the thunderbolt driver’s directory parsing routine, where the function __tb_property_parse_dir fails to verify that the sum of content_offset and content_len does not exceed the block length for the root directory. This omission allows the driver to read beyond the allocated property block, potentially leaking kernel memory content to user space. The weakness is an out‑of‑bounds read due to a bounds‑check bypass.

All unpatched Linux kernel builds that include the thunderbolt subsystem are impacted. The affected code is part of the generic kernel tree, so any distribution shipping a kernel prior to the referenced patch commits is vulnerable, regardless of vendor distribution.

Based on the description, it is inferred that the attack vector requires local execution to trigger the Thunderbolt property parser and cause the out‑of‑bounds read. There is no known public exploit and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. An attacker with local privileges could read kernel memory, but remote code execution is not possible. Consequently, the risk is moderate for systems hosting untrusted users, but prompt remediation is recommended to prevent accidental or malicious information disclosure.