This flaw occurs in the Thunderbolt driver when a delayed work task is queued after the domain is removed. The task runs on a system workqueue and accesses a freed domain structure, leading to a use‑after‑free. The immediate effect is memory corruption that could crash the kernel or allow an attacker to execute code if the freed memory is reused. The weakness is a classic use‑after‑free (CWE‑416).

All Linux kernel implementations that include the Thunderbolt subsystem before the commit that adds the removal flag and lock protection are vulnerable. No specific release numbers are listed, so any kernel build with the pre‑commit code for tb_xdp_handle_request, tb_xdomain_remove, and tb_xdomain_unregister is affected. Systems with Thunderbolt devices connected to the kernel are exposed.

The flaw requires a local attacker with the ability to trigger a Thunderbolt disconnect and schedule delayed work. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited evidence of active exploitation. Nevertheless, a use‑after‑free can lead to arbitrary code execution or denial of service, which is typically classified as high severity. The lack of a published CVSS score does not diminish the risk derived from the nature of the exploitation path.