The Linux kernel Thunderbolt subsystem accepts property entries that have a zero length for DIRECTORY, DATA, and TEXT types. When a TEXT entry with length zero is processed, the validator writes a null terminator at the offset property->value.text[property->length * 4 - 1], which evaluates to -1 when length is zero. This results in an out‑of‑bounds write before the beginning of the allocated buffer, corrupting adjacent kernel memory. If an attacker can supply a malicious Thunderbolt property entry, this memory corruption can be leveraged to achieve privilege escalation or arbitrary code execution, making the flaw a serious kernel vulnerability.

The affected product is the Linux kernel itself, as indicated by the vendor and product information and the CPE string. No particular kernel version is listed, so any current or older Linux kernel releases that include the Thunderbolt driver are potentially impacted until the patch is applied.

There is no CVSS or EPSS score listed, and the vulnerability is not listed in the CISA KEV catalog; the nature of the flaw implies a high severity. The attack vector is likely local, requiring the attacker to supply a crafted Thunderbolt device or property entry. In environments where Thunderbolt devices are active, an attacker with physical access could trigger the underflow and exploit the resulting memory corruption.