The vulnerability resides in the Thunderbolt subsystem of the Linux kernel. The driver indexes its local group_reserved[] array directly by the group ID, which is valid from 1 to MAX_GROUPS. The array, however, is allocated only MAX_GROUPS entries; thus the group ID equal to MAX_GROUPS points one element past the end, causing an out‑of‑bounds read. The final group's reserved bandwidth value is omitted when the array is summed, leading to inaccurate bandwidth accounting for the processed data paths.

All Linux kernel versions that contain the Thunderbolt drivers before the commit that adds an extra element to the group_reserved[] array are affected. Any distribution using such a kernel build is potentially impacted, regardless of the specific vendor or package manager.

The defect is an internal out‑of‑bounds read with no external trigger or remote control capability. It is not listed in the CISA KEV catalog and no EPSS score is available; therefore the likelihood of exploitation is low. The main consequence is incorrect bandwidth metrics; no compromise of confidentiality, integrity or availability is expected from the vulnerability itself.