A high-severity buffer overflow vulnerability in the Linux kernel Thunderbolt driver could allow a local authenticated attacker to achieve code execution or system instability.

The Thunderbolt driver fails to correctly size the group_reserved array, leading to an out-of-bounds memory access when indexing with valid group IDs. This flaw permits a local attacker with low privileges to trigger memory corruption, potentially leading to privilege escalation or a kernel panic.

The potential for kernel-level memory corruption poses a significant risk to system integrity and availability. An attacker capable of exploiting this flaw could gain unauthorized elevated privileges, bypass security controls, or cause a denial of service by crashing the host system. Given the CVSS 3.1 score of 7.8, this vulnerability is classified as high risk, particularly in multi-user environments or systems where local access is provided to untrusted users.

Immediate Action: Update the Linux kernel to version 6.12.104, 6.18.45, 7.1.9, or later versions where the fix has been backported.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation fault errors related to the Thunderbolt driver, which may indicate attempted exploitation.

Compensating Controls: Restrict access to physical Thunderbolt ports and limit user-level access to kernel configuration interfaces where possible to reduce the attack surface.

Public Exploit Available: Unknown.

Organizations should prioritize the deployment of the provided kernel patches to all affected Linux distributions. Because this vulnerability exists within the kernel memory space, successful exploitation could have severe consequences for system-wide security. Administrators should verify their kernel version against the provided fixed releases and schedule maintenance windows to ensure these updates are applied promptly.