In the Linux kernel, the Thunderbolt subsystem’s property parsing logic allows a 32‑bit overflow when summing a property value and length. A malicious XDomain peer can craft a property entry with value 0xffffff00 and length 0x100, causing the sum to wrap to zero and bypass the block length check. The offset is then interpreted by tb_property property block and the kernel reads beyond the allocated memory. The read is NUL‑bounded and can expose sensitive kernel data, especially for TEXT‑typed entries such as deviceid or vendorid, which are subsequently revealed through per‑XDomain sysfs attributes.

All Linux kernel versions that include Thunderbolt support prior to the commit that fixes the overflow (commit 01deda015…). The affected vendor is Linux, product Linux kernel.

The CVSS score of 8.1 places this vulnerability in the high‑severity range. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a malicious Thunderbolt device or an XDomain peer that can send crafted property entries to the host, so the attack vector is local via device attachment.