A race condition between tb_remove_work() and tb_domain_remove() in the Linux kernel can lead to a NULL pointer dereference inside tb_free_unplugged_xdomains(), causing a kernel panic. The vulnerable code accesses tb->root_switch without verifying that it is non‑null, which would terminate the system with a core dump. The impact is a denial of service: a local attacker who can trigger the race can force the kernel to crash, potentially allowing disruption of the host or subsequent exploitation in environments that rely on uninterrupted kernel operation.

The vulnerability exists in the generic Linux kernel. No specific kernel versions are listed in the data, so any installation that has not applied the patch commit a8937f35cf39 is potentially affected. The product is broadly available as Linux:Linux.

The CVSS score is not provided, and the EPSS score is unavailable, indicating limited data on exploitation likelihood. The CVE is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation incidents. However, because the flaw causes a kernel crash, an attacker who can induce the race (for example, by manipulating Thunderbolt devices or drivers) could immediately achieve a denial of service. The attack vector would be local and relies on interacting with the Thunderbolt subsystem; remote exploitation is unlikely without additional privileges or system access.