The Linux kernel’s Thunderbolt driver contains an array for reserved bandwidth per group. Group IDs run from 1 to MAX_GROUPS, but the array has only MAX_GROUPS elements, indexed 0 to MAX_GROUPS-1. When the driver indexes the array using a group ID of MAX_GROUPS, it accesses one element past the array’s end, causing an out‑of‑bounds read and excluding the final group’s bandwidth from aggregate calculations. This defect is a classic out‑of‑bounds array access flaw (CWE‑788) that results in inaccurate bandwidth accounting.

Any Linux kernel version that includes the Thunderbolt driver and predates the commit that expands the group_reserved array to MAX_GROUPS + 1 is affected. This encompasses the default kernels shipped by major Linux distributions as well as custom kernel builds that have not applied the patch.

According to the CVSS score of 7.8, the vulnerability is classified as high severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation. The absence of a listing in CISA’s KEV catalog further suggests that no widespread attacks have been observed. While the description does not explicitly state an attack vector, it is inferred that the flaw could be triggered by communicating with a Thunderbolt device that exercises the bandwidth calculation path; however, no direct mechanism to compromise confidentiality, integrity, or availability is documented. Therefore, the immediate risk is mainly to the accuracy of bandwidth monitoring rather than to system compromise.