The Linux kernel's Thunderbolt property validator function tb_property_entry_valid() incorrectly accepts entries with length zero for DIRECTORY, DATA, and TEXT types. Specifically, a zero-length TEXT entry passes validation but triggers an underflow in the null-termination logic, writing a null byte at an offset of -1 relative to the allocated buffer. This memory corruption is due to the expression property->value.text[property->length * 4 - 1] = '\0' when property->length is zero. The vulnerability is mitigated by rejecting zero-length entries early in the validator, as such entries have no valid representation in the XDomain property protocol.

The vulnerability causes an out-of-bounds write (underflow) in kernel memory, which can lead to denial of service (kernel crash) or potentially other undefined behavior. The CVSS vector indicates local attack vector with low complexity and low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted Thunderbolt property entries with zero length. Monitor vendor channels for updates and apply official patches once released.