When a Thunderbolt service is shut down, the kernel releases the XDomain reference before the service ID array, which is owned by the parent XDomain, has been fully cleaned up. This premature release creates a dangling pointer that can be used to perform a use‑after‑free operation, potentially corrupting memory and causing instability or unexpected behavior in the kernel.

Linux systems running kernel versions that include the Thunderbolt driver before the commit that fixes the premature release. The issue applies to any kernel build where the Thunderbolt service lifecycle is active and the fix has not yet been merged; no specific version numbers are provided, so all kernels that include the relevant commit should be evaluated.

The CVSS score of 8.8 indicates high severity. The EPSS score is <1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no widely known exploitation at this time. Based on the nature of a use‑after‑free in kernel space, the likely attack vector is local; an attacker would need some way to trigger the service release path. The overall risk remains significant because a successful exploit can lead to memory corruption or kernel compromise, but the exact likelihood of exploitation is uncertain due to lack of public exploit evidence.