The vulnerability is in the Linux kernel Thunderbolt driver where stopping a Thunderbolt domain fails to tear down inactive DisplayPort tunnels, leaving delayed work queued for a tunnel that has already been removed. The queued work requeues until the DisplayPort receive timeout expires, preventing the domain removal routine from completing. When the deferred work eventually runs, it operates on a domain that no longer exists, causing a use‑after‑free that can lead to a kernel crash or, if initiated by a malicious Thunderbolt device, arbitrary code execution. This weakness is a classic use‑after‑free (CWE-416).

The issue is present in all Linux kernel releases containing the unpatched Thunderbolt driver. Any system that loads the thunderbolt kernel module and uses Thunderbolt peripherals is potentially affected. The specific kernel versions are not enumerated in the advisory, but the problem was fixed in later commits referenced in the advisory.

No CVSS or EPSS score is provided, but the nature of a kernel use‑after‑free indicates a high intrinsic impact if exploited. The bug requires a Thunderbolt device that can create DP tunnels and then cause the domain to stop, giving an attacker a local or physical access vector. No public exploits or KEV listing exist at this time; however, a malicious peripheral could leverage this weakness to cause a denial of service or privilege escalation. Until a patch is applied, the safest mitigation is to use the latest kernel release that contains the fix.