The Linux kernel thunderbolt subsystem had a vulnerability in __tb_property_parse_dir() where entries with entry->length (dir_len) less than 4 caused two out-of-bounds conditions: a kmemdup call reading beyond the property block and a size_t underflow leading to excessive iteration and out-of-bounds access. The fix rejects dir_len values below 4 before the kmemdup call, preventing these memory safety issues. Additionally, list initialization was moved to prevent kernel oops on error paths.

This vulnerability could cause out-of-bounds memory reads and size_t underflow in the kernel, potentially leading to kernel crashes (oops) or memory corruption. There is no evidence of known exploits in the wild. The impact is limited to kernel stability and memory safety within the thunderbolt property parsing code.

A fix has been implemented in the Linux kernel to reject dir_len values less than 4 before performing memory operations, closing the out-of-bounds and underflow issues. Users should apply the official kernel updates containing this fix when available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.