The Linux kernel's Thunderbolt property parser (__tb_property_parse_dir) previously lacked a recursion depth counter when processing DIRECTORY entries, allowing a crafted peer to create a back-reference loop that causes unbounded recursion. This leads to kernel stack exhaustion and triggers a guard page fault. The vulnerability can be exploited by any untrusted XDomain peer that reaches the PROPERTIES_REQUEST control-plane exchange without requiring authentication. The fix involves threading a depth counter through the parsing functions and rejecting property blocks exceeding a maximum depth of 8, which is higher than any legitimate XDomain layout. Additionally, the kernel command line option thunderbolt.xdomain=0 can disable the vulnerable path entirely for operators who do not require XDomain host-to-host discovery.

Exploitation of this vulnerability results in kernel stack exhaustion and a guard page fault, which can cause a denial of service (system crash) on affected Linux systems. The vulnerability can be triggered remotely by untrusted peers on the Thunderbolt XDomain interface without authentication, potentially allowing disruption of system availability.

A fix has been implemented by adding a recursion depth limit of 8 in the Thunderbolt property parser functions. Operators who do not require XDomain host-to-host discovery can disable the vulnerable code path by setting the kernel command line parameter thunderbolt.xdomain=0. Patch status is not yet confirmed from vendor advisories; users should monitor official Linux kernel advisories for updates and apply patches when available.