A defect in the Linux kernel Thunderbolt driver causes a memory leak when tb_cfg_request() fails during __tb_xdomain_response(). The failing request is not released, which results in the allocation remaining in memory and leaking on error return. This failure to free resources enables an attacker to exhaust memory over time, which could degrade system performance or lead to a denial‑of‑service condition. The underlying weakness is improper resource management, which aligns with the CWE‑772 classification.

The vulnerability exists in any Linux kernel implementation that includes the Thunderbolt driver, as represented by the vendor ‘Linux’ and product ‘Linux kernel’. Specific version information was not provided in the advisory, so all kernel releases prior to the applied fix are considered affected. Users should verify that their system’s kernel includes the updated tb_cfg_request_put() call path.

The CVSS score is 5.5, indicating a moderate severity. The EPSS score is < 1%, showing a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local; an attacker who can send Thunderbolt configuration requests could trigger tb_cfg_request() failures, causing repeated memory leaks. While no remote exploitation path is described, the gradual memory consumption could lead to a denial‑of‑service if repeated enough times. No known exploits are reported, but the risk of silent resource exhaustion remains.