The vulnerability is a recursion bug in the Linux kernel’s Thunderbolt host driver. During a PROPERTIES_REQUEST exchange, a crafted DIRECTORY entry can cause __tb_property_parse_dir() to call itself indefinitely, exhausting the kernel stack and triggering a guard‑page fault that results in a kernel panic. This flaw is an example of unchecked input leading to resource exhaustion (CWE‑606), and it allows an attacker to cause a denial of service without authentication.

All Linux kernel implementations that do not include the recent patch adding a depth counter to the thunderbolt property parsing code are affected. The defect is confined to the Thunderbolt host driver across all distributions that have shipped a kernel before the fix. Kernels that have already incorporated the commit, or those that have booted with thunderbolt.xdomain=0 to disable the vulnerable path, are not vulnerable.

The CVSS score of 7.0 reflects moderate severity, while the EPSS score of less than 1 % indicates a low probability of exploitation. Based on the description, the attacker must physically connect a malicious Thunderbolt device—such as a cable, dock, or inline inspector—to the host system’s Thunderbolt port to trigger the exploit. No network access or prior authentication is required, and the impact is a full kernel crash that brings the entire system down. Although the vulnerability is not listed in CISA's KEV catalog, the potential for a system‑wide denial of service remains significant.