An asymmetry in the USB core connector unbind path caused a dangling pointer to a freed Type‑C USB device, allowing stale references to be used during Thunderbolt hot‑plug events. The resulting use‑after‑free conditions corrupt the UCSI state and can trigger Intel I225/igc NIC failures, kernel warnings, and potentially stalls or crashes. The primary impact is loss of device functionality and system stability on affected hardware.

This bug is present in the Linux kernel whenever the connector_unbind/connector_bind mismatch exists; no specific version list is available, so any kernel revision lacking the applied fix is potentially vulnerable. Systems employing Thunderbolt docks that include Intel I225 or igc NICs are the most susceptible, but the underlying kernel flaw could affect other Type‑C devices that trigger the same teardown race.

The CVSS score for this CVE is 5.5, and the EPSS score is <1%, indicating a moderate likelihood of exploitation. The exploit requires a physical or privileged access scenario to unplug and re‑plug a Thunderbolt dock in a specific timing window that triggers the race. Because the flaw manifests as a use‑after‑free and kernel de‑initialization bug, an attacker could potentially extend this to arbitrary code execution, but such exploitation is not documented. The risk is therefore considered high for environments where long‑term uptime and hardware reliability are critical.