The kernel’s Thunderbolt driver mishandles property entries whose declared length (dir_len) is less than four bytes. When a non‑root attacker crafts such an entry, the driver blindly copies four 32‑bit dwords and then computes a negative content length that underflows to a huge size_t value. This causes out‑of‑bounds reads and can trigger a kernel oops, effectively crashing the system. The impact is a denial‑of‑service condition at kernel level, potentially allowing an attacker to disrupt system operation. The issue stems from a size_t underflow and improper input validation (CWE‑125).

All Linux kernels that lack the patch rejecting dir_len values below four on the non‑root path are affected. The flaw resides in the Thunderbolt driver prior to the commit that added the fix. No specific vendor or version numbers are listed, so any system running a pre‑patch kernel build is potentially vulnerable. Based on the lack of detailed version information, it is inferred that all such kernels are underflow in the Thunderbolt subsystem of the Linux kernel allows a non‑root user to craft a property with a length less than four. The kernel copies four dwords regardless of the reported length and then computes a negative content length that underflows to a very large size_t value. This causes out‑of‑bounds reads and may trigger a kernel oops, resulting in a denial‑of‑service condition in kernel space.

The flaw requires only a local non‑root attacker and operates in user space before the Thunderbolt property is fully processed. The CVSS score of 5.5 classifies the vulnerability as medium severity. The EPSS score of less than 1% and its absence from CISA's KEV catalog indicate a low likelihood of current exploitation. Nevertheless, a kernel oops can still cause a denial‑of‑service and may serve as an escalation vector for further compromise.