The vulnerability resides in the Linux kernel's thunderbolt subsystem where a router reference is omitted for each allocated HopID. As a result, tb_stop drops references without deactivating DP tunnels, allowing tunnels to outlive the router objects and trigger use‑after‑free errors such as "ida_free called for id=… which is not allocated." An attacker can provoke the flaw by unbinding the thunderbolt driver while a DP tunnel is still awaiting a DPRX capability read, a scenario that can occur when a USB‑4 cable is unplugged on an Apple NHI device. The memory corruption could enable an attacker to gain kernel privileges or execute arbitrary code.

Linux kernel builds that include the thunderbolt driver but predates the commit introducing the router reference fix are affected. The CNA data lists Linux kernels generically; no specific version numbers are provided. Any distribution running an older kernel that has not yet incorporated the commit is potentially vulnerable.

No CVSS or EPSS score is available, and the flaw is not listed in the CISA KEV catalog, indicating limited evidence of exploitation. The attack vector appears to require local control or privileged access to unbind the driver, and the vulnerability manifests as kernel memory corruption. Until a patched kernel is deployed, the risk is theoretical but could be high if an attacker can manipulate the driver state.