A race condition between tb_remove_work() and tb_domain_remove() in the Linux kernel can lead to a NULL pointer dereference inside tb_free_unplugged_xdomains(), causing a kernel panic. The vulnerable code accesses tb->root_switch without verifying that it is non‑null, which would terminate the system with a core dump. The impact is a denial of service: based on the description, it is inferred that a local attacker could trigger the race and force the kernel to crash, potentially allowing disruption of the host or subsequent exploitation in environments that rely on uninterrupted kernel operation.

The vulnerability exists in the generic Linux kernel. No specific kernel versions are listed in the data, so any installation that has not applied the patch commit a8937f35cf39 is potentially affected. The product is broadly available as Linux:Linux.

The CVSS score is 4.1, indicating a medium impact, and the EPSS score is very low (<1%), suggesting limited likelihood of exploitation. The CVE is not listed in the CISA KEV catalog, so no large‑scale attacks are recorded. Nevertheless, because the flaw causes a kernel crash, it can be inferred that an attacker who can induce the race—by manipulating Thunderbolt devices or drivers—might immediately achieve a denial of service. Based on the description, it is inferred that the attack vector would be local and relies on interacting with the Thunderbolt subsystem; remote exploitation is unlikely without additional privileges or system access.