Based on the description, the Thunderbolt driver in the Linux kernel allocates a 252‑byte response buffer for XDomain properties but limits the usable length field to six bits. A malicious Thunderbolt peer can set this field to 63, causing the driver to calculate 48 dwords of data. Since the allocated array contains only 180 bytes, the memcpy reads 192 bytes, leading to a 12‑byte heap out‑of‑bounds read. This read can expose kernel memory contents, potentially leaking sensitive data.

All Linux kernel releases that contain the vulnerable Thunderbolt code before the upstream fixes in commits 322e93448d90 and 4db2bd2ed478. No specific version range is listed, so any kernel prior to the patched code is impacted.

Based on the description, the vulnerability can be exploited by a malicious Thunderbolt device sending crafted XDomain responses to the kernel. This requires the attacker to have physical or local access to a Thunderbolt interface, so the attack vector is likely local or device‑connected. The EPSS score is < 1% and the CVSS score is 6.8, with the vulnerability not listed in CISA KEV, which suggests a moderate risk of exploitation. The low exploitation probability indicates that widespread exploitation has not yet been observed.