A high-severity use-after-free vulnerability in the Linux kernel Thunderbolt driver poses a significant risk of system instability or potential code execution.

The flaw exists within the Thunderbolt XDomain request handling logic, where delayed work queues are not properly managed during device disconnection. This allows an unauthenticated attacker with physical or adjacent access to trigger a use-after-free condition.

This vulnerability carries a CVSS score of 8.8, indicating a high potential for system compromise. Successful exploitation could lead to local privilege escalation or arbitrary code execution, resulting in full system control, data theft, or prolonged operational downtime for affected hardware.

Immediate Action: Update the Linux kernel to version 6.6.151, 6.12.103, 6.18.44, 7.1.8, or later as appropriate for your specific distribution.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected Thunderbolt driver crashes, which may indicate attempted exploitation.

Compensating Controls: If patching is delayed, restrict physical access to Thunderbolt ports on sensitive systems to prevent unauthorized device connection.

Public Exploit Available: Unknown

Given the potential for kernel-level impact, this vulnerability must be treated with high priority. Organizations should schedule kernel updates during the next maintenance window to ensure systems are protected against this use-after-free defect.