A use‑after‑free bug exists in the Linux kernel Thunderbolt driver. When a hotplug event is queued after the domain has been removed, the queued handler may operate on a freed domain reference, allowing an attacker to corrupt kernel memory and potentially elevate privileges. The flaw could enable arbitrary code execution at the kernel level, but the impact depends on the attacker’s ability to trigger the precise sequence described.

The flaw affects the Linux kernel. No specific version ranges are listed, so any kernel that contains the old hotplug handling logic before the commit that fixes the reference issue is potentially vulnerable.

The CVSS score of 4.1 indicates medium numerical severity. The EPSS score of <1% indicates a very low probability that attackers will target or exploit this vulnerability in the near term. The vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector involves a local user who can trigger a thunderbolt hotplug event after unloading the driver, which the description infers. Because the flaw requires specific timing against the driver removal and relies on a use‑after‑free in kernel code, successful exploitation is considered difficult, leaving the overall risk low at present.