During stress testing of the Linux kernel Thunderbolt driver, a use‑after‑free condition was observed when control channel requests were canceled. The freed request structure was accessed again by the workqueue, causing memory corruption that could culminate in a crash or, if an attacker can influence the payload, remote code execution. This flaw is a classic use‑after‑free bug, identified as CWE‑416.

The vulnerability affects the Thunderbolt driver in the Linux kernel. The fix is contained in recent kernel commits such as 08287212b… All Linux kernel releases prior to receiving this patch are potentially vulnerable. Specific version numbers are not listed, so any kernel version that includes the troubled code path, especially during Thunderbolt control channel operations, is at risk.

The CVSS score and EPSS are not provided, but the nature of a use‑after‑free gives the flaw a moderate to high potential impact. The attacker would need either local kernel write access or the ability to manipulate Thunderbolt requests, which is typically limited but not impossible in environments with exposed Thunderbolt devices. The vulnerability is not listed in CISA's KEV catalog, and no public exploit is known as of now.