The bug resides in the Linux kernel’s thunderbolt subsystem where a router reference is not taken for each allocated HopID. When tb_stop() drops all DP tunnel references without deactivating them, tunnels may outlive the router objects. This creates a use‑after‑free condition that, upon HopID release, operates on freed IDAs and produces warnings such as “ida_free called for id=8 which is not allocated.” The flaw can be triggered by unbinding the driver while a DP tunnel is awaiting a DPRX capability read, especially during a USB‑4 cable unplug on an Apple NHI device. The resulting kernel memory corruption could lead to undefined kernel behaviour.

Linux kernel builds that still contain the thunderbolt driver before the commit that adds router reference handling are affected. The CNA data lists the product generically as “Linux kernel”, with no specific version numbers. Distributions running a kernel older than the commit that fixes the router reference omission are potentially vulnerable.

The CVSS score of 4.1 denotes moderate severity, and the EPSS score of less than 1% signals a very low probability of exploitation. The vulnerability is not included in the CISA KEV catalog. The likely attack vector is local or privileged, requiring the ability to unbind the thunderbolt driver or physically unplug a USB‑4 cable when a DP tunnel is active. Because the flaw triggers a use‑after‑free that can corrupt kernel memory, an attacker with sufficient privileges could potentially turn the bug into a kernel compromise, though privilege escalation is not explicitly stated in the description.