The Linux thunderbolt driver contained a flaw where a domain reference acquired for a DP tunnel was released only in one execution path. If the associated DPRX read is canceled, the work queue task aborts and the reference is never freed, creating a leak. When the driver is later unbound, the kernel stalls waiting for a completion that never completes, effectively locking the driver and potentially the system. An attacker could trigger the scenario by unplugging a thunderbolt device during its setup period before the DPRX read finishes, resulting in a denial‑of‑service.

This issue affects the Linux kernel’s thunderbolt subsystem. The CNA data lists the vendor as Linux with no specific version range provided, implying all kernel releases that contain the thunderbolt driver (the mainline kernel and derived distributions) are potentially vulnerable. No product alias or version restriction is disclosed in the available data.

The CVSS score is not available, the EPSS score is unavailable, and the vulnerability is not listed in CISA KEV. The flaw requires physical unplugging of a thunderbolt device while a read operation is in flight, which is feasible for local or supervisory attackers but less likely to be exploited remotely. The potential impact is a local denial‑of‑service that could affect unattended or critical systems. Given the kernel nature of the flaw, a patch from the vendor is the most reliable defense rather than misconfiguration or temporary workarounds.