The Linux kernel Thunderbolt driver contains an unchecked array index: the six‑bit field dual_link_port_nr read from a device’s DROM may exceed the allocated sw->ports[] array. This allows a malicious or malformed Thunderbolt device to cause an out‑of‑bounds pointer write that is later dereferenced, potentially corrupting kernel memory and giving the attacker arbitrary code execution or a system crash.

Any Linux kernel build that includes the Thunderbolt driver and has not yet been updated with the patch is vulnerable. The exact versions are not listed, but all kernels running the unpatched driver are affected.

Because the flaw permits out‑of‑bounds memory writes in kernel space, exploitation could lead to privilege escalation. The attacker would need physical access to a Thunderbolt device that can provide a malicious DROM payload. No CVSS score or EPSS data is available, but the inherent nature of the vulnerability—unbounded array indexing in the kernel—indicates a high severity. This vulnerability is not yet listed in CISA’s KEV, suggesting no widespread exploitation, but the risk remains significant if a compromised device is attached.