In the Linux kernel Thunderbolt driver, a flaw allows an attacker to send a packet with 19 or more small frames, which causes tbnet_check_frame to accept a frame_count higher than the system can handle. The resulting skb_add_rx_frag writes past the frags[] array, corrupting memory after the skb shared info. This out‑of‑bounds write can be leveraged to corrupt kernel data structures, potentially executing arbitrary code with kernel privileges.

Vulnerable systems are Linux kernel installations that include the Thunderbolt IP driver before the patch commit 2b3b4e5ff5a58ad32817824b0310e63908b12052. The issue was fixed in later kernel releases that applied this change. Any product using the generic Linux kernel and supporting Thunderbolt connectivity is impacted.

The vulnerability is a classic buffer overflow that leads directly to kernel memory corruption. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, yet out‑of‑bounds writes in the kernel typically carry a very high risk of remote code execution. The attack requires a malicious Thunderbolt device or connection; once the kernel is corrupted, an attacker could gain full system privileges.