In the Linux kernel's Thunderbolt networking module, the function tb_xdomain_alloc_in_hopid() assigns a HopID to XDomain connections without correctly releasing the ID when it does not match the expected value. Because tbnet_connected_work() silently consumes the allocated ID on failure and never frees it, the identifier remains reserved for the lifetime of the XDomain connection. This unreleased resource can accumulate over time, consuming the finite pool of HopIDs and potentially leading to exhaustion that disrupts new connections, effectively causing a denial of service.

All Linux kernel distributions that include the Thunderbolt networking implementation are affected. No specific kernel version range is listed in the provided data, so the vulnerability applies to any kernel where this code path is present before the patch.

The CVSS score of 4.8 indicates moderate severity, and the EPSS is not available for this record. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at this time. Attackers would need local access to a system configured for Thunderbolt XDomain networking and to repeatedly initiate connections that trigger HopID allocation. The impact would mainly be resource exhaustion leading to service disruption.