The Linux thunderbolt driver previously failed to reset the root switch pointer when a domain was stopped, leaving tb->root_switch pointing at a stale object. When tb_xdp_handle_request() is invoked for that stopped domain, the function could dereference the invalid pointer, which may lead to kernel instability or crash and provides an error response to the remote host. The patch assigns tb->root_switch to NULL, causing tb_xdp_handle_request() to return an error instead of accessing bad memory. The likely attack vector is remote: an attacker must be able to send an XDP request to a thunderbolt domain that has already been stopped.

All Linux kernel distributions that contain the thunderbolt driver prior to the patch are potentially vulnerable. The CNA list and CPE entry refer generically to the Linux kernel, so any kernel version lacking the patch could be affected regardless of distribution.

The CVSS score of 7.5 indicates high severity. The EPSS score is less than 1%, implying a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that a stale pointer could allow a remote host to trigger tb_xdp_handle_request on a stopped domain, potentially causing a kernel crash or other disruptive behavior.