The vulnerability is in the Linux kernel Thunderbolt driver where stopping a Thunderbolt domain fails to tear down inactive DisplayPort tunnels, leaving delayed work queued for a tunnel that has already been removed. The queued work requeues until the DisplayPort receive timeout expires, preventing the domain removal routine from completing. When the deferred work eventually runs, it operates on a domain that no longer exists, causing a use‑after‑free (CWE‑459) that can lead to a kernel crash.

The issue is present in all Linux kernel releases containing the unpatched Thunderbolt driver. Any system that loads the thunderbolt kernel module and uses Thunderbolt peripherals is potentially affected. The specific kernel versions are not enumerated in the advisory, but the problem was fixed in later commits referenced in the advisory.

The CVSS score of 1.9 classifies this flaw as low severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability remains a classic use‑after‑free (CWE‑459) that can cause a kernel crash. No public exploits are known, and the flaw is not listed in the CISA KEV catalog. The risk to a target is primarily local or physical access; an attacker would need a malicious Thunderbolt device to trigger the flaw, after which a denial‑of‑service or kernel crash could occur.