CVE-2026-80736 (GCVE-0-2026-80736)

Vulnerability from cvelistv5 – Published: 2026-09-03 08:21 – Updated: 2026-09-04 04:58
VLAI
Title
thunderbolt: Fix bandwidth group reservation indexing
Summary
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth group reservation indexing Valid bandwidth group IDs range from 1 through MAX_GROUPS, while Group ID 0 is reserved. tb_consumed_dp_bandwidth() uses the Group ID directly to index its local group_reserved[] array. The array currently has MAX_GROUPS entries, so its valid indices are 0 through MAX_GROUPS - 1. Group ID MAX_GROUPS therefore accesses one element past the end, and the final group's reserved bandwidth is not included when the array is summed. Give group_reserved[] MAX_GROUPS + 1 entries so direct Group ID indexing covers the reserved ID 0 and valid IDs 1 through MAX_GROUPS.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 52a4490e89d7c4effe613d8dffd2ac0a2a786bd7 , < 0bfb67ba366cd68d1d0ad935760577bae1d5df27 (git)
Affected: 52a4490e89d7c4effe613d8dffd2ac0a2a786bd7 , < 9977321835c7ae71d12a43bed7baa5bd514d01c3 (git)
Affected: 52a4490e89d7c4effe613d8dffd2ac0a2a786bd7 , < 0a8c9ed4f166216642a8c084f0de415169c88088 (git)
Affected: 52a4490e89d7c4effe613d8dffd2ac0a2a786bd7 , < d2ee4d47aacbd2ba456092eeec670dba35fde291 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/thunderbolt/tb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0bfb67ba366cd68d1d0ad935760577bae1d5df27",
              "status": "affected",
              "version": "52a4490e89d7c4effe613d8dffd2ac0a2a786bd7",
              "versionType": "git"
            },
            {
              "lessThan": "9977321835c7ae71d12a43bed7baa5bd514d01c3",
              "status": "affected",
              "version": "52a4490e89d7c4effe613d8dffd2ac0a2a786bd7",
              "versionType": "git"
            },
            {
              "lessThan": "0a8c9ed4f166216642a8c084f0de415169c88088",
              "status": "affected",
              "version": "52a4490e89d7c4effe613d8dffd2ac0a2a786bd7",
              "versionType": "git"
            },
            {
              "lessThan": "d2ee4d47aacbd2ba456092eeec670dba35fde291",
              "status": "affected",
              "version": "52a4490e89d7c4effe613d8dffd2ac0a2a786bd7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/thunderbolt/tb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Fix bandwidth group reservation indexing\n\nValid bandwidth group IDs range from 1 through MAX_GROUPS, while Group\nID 0 is reserved. tb_consumed_dp_bandwidth() uses the Group ID directly\nto index its local group_reserved[] array.\n\nThe array currently has MAX_GROUPS entries, so its valid indices are 0\nthrough MAX_GROUPS - 1. Group ID MAX_GROUPS therefore accesses one\nelement past the end, and the final group\u0027s reserved bandwidth is not\nincluded when the array is summed.\n\nGive group_reserved[] MAX_GROUPS + 1 entries so direct Group ID\nindexing covers the reserved ID 0 and valid IDs 1 through MAX_GROUPS."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached through the local Thunderbolt connection manager control channel (TB_CFG_ERROR_DP_BW notifications into tb_handle_dp_bandwidth_request/tb_alloc_dp_bandwidth), not over IP; on systems with authorized TB docks/workstations, DP bandwidth recalculation can be driven without new network access.\nAC:L - After an authorized topology uses bandwidth group 7 with reserved DP bandwidth, the out-of-bounds write at group_reserved[7] is deterministic whenever tb_consumed_dp_bandwidth() runs; an attacker can induce the needed bandwidth reductions/mode changes rather than depending on uncontrollable timing.\nPR:L - The vulnerable path performs no credential checks; once Thunderbolt devices are authorized (common with security level none or boot ACL), an unprivileged local user can trigger DP bandwidth allocation events via display/mode changes that cause DPTX bandwidth notifications.\nUI:N - No victim interaction is required beyond normal authorized Thunderbolt/DisplayPort operation; a local attacker can directly cause the bandwidth-change notifications that reach tb_consumed_dp_bandwidth() without convincing another user to perform a separate action.\nS:U - Impact is kernel stack corruption during Thunderbolt bandwidth accounting in the host kernel; it does not cross a VM/host, IOMMU/DMA, or sandbox security boundary and stays within the same kernel security authority.\nC:H - Indexing group_reserved[] with group ID 7 writes one 32-bit word past a seven-element stack array, corrupting adjacent stack data with attacker-influenced reserved-bandwidth values and enabling kernel memory disclosure primitives.\nI:H - This is a kernel stack out-of-bounds write with partially attacker-controlled values (reserved Mb/s), which can corrupt pointers/control data on the stack and be leveraged for arbitrary kernel memory modification or privilege escalation.\nA:H - Corrupting kernel stack variables in tb_consumed_dp_bandwidth() can cause immediate kernel oops/panic or hang during bandwidth accounting, and unstable stack corruption commonly produces severe system unavailability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T04:58:21.747Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0bfb67ba366cd68d1d0ad935760577bae1d5df27"
        },
        {
          "url": "https://git.kernel.org/stable/c/9977321835c7ae71d12a43bed7baa5bd514d01c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a8c9ed4f166216642a8c084f0de415169c88088"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2ee4d47aacbd2ba456092eeec670dba35fde291"
        }
      ],
      "title": "thunderbolt: Fix bandwidth group reservation indexing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80736",
    "datePublished": "2026-09-03T08:21:51.946Z",
    "dateReserved": "2026-08-26T14:34:25.789Z",
    "dateUpdated": "2026-09-04T04:58:21.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80736",
      "date": "2026-09-21",
      "epss": "0.00163",
      "percentile": "0.05935"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/thunderbolt/tb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0bfb67ba366cd68d1d0ad935760577bae1d5df27",
                    "status": "affected",
                    "version": "52a4490e89d7c4effe613d8dffd2ac0a2a786bd7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9977321835c7ae71d12a43bed7baa5bd514d01c3",
                    "status": "affected",
                    "version": "52a4490e89d7c4effe613d8dffd2ac0a2a786bd7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0a8c9ed4f166216642a8c084f0de415169c88088",
                    "status": "affected",
                    "version": "52a4490e89d7c4effe613d8dffd2ac0a2a786bd7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d2ee4d47aacbd2ba456092eeec670dba35fde291",
                    "status": "affected",
                    "version": "52a4490e89d7c4effe613d8dffd2ac0a2a786bd7",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/thunderbolt/tb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.9"
                  },
                  {
                    "lessThan": "6.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.104",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.45",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Fix bandwidth group reservation indexing\n\nValid bandwidth group IDs range from 1 through MAX_GROUPS, while Group\nID 0 is reserved. tb_consumed_dp_bandwidth() uses the Group ID directly\nto index its local group_reserved[] array.\n\nThe array currently has MAX_GROUPS entries, so its valid indices are 0\nthrough MAX_GROUPS - 1. Group ID MAX_GROUPS therefore accesses one\nelement past the end, and the final group\u0027s reserved bandwidth is not\nincluded when the array is summed.\n\nGive group_reserved[] MAX_GROUPS + 1 entries so direct Group ID\nindexing covers the reserved ID 0 and valid IDs 1 through MAX_GROUPS."
          }
        ],
        "id": "CVE-2026-80736",
        "lastModified": "2026-09-04T05:17:14.137",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-03T13:06:12.480",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0a8c9ed4f166216642a8c084f0de415169c88088"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0bfb67ba366cd68d1d0ad935760577bae1d5df27"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9977321835c7ae71d12a43bed7baa5bd514d01c3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d2ee4d47aacbd2ba456092eeec670dba35fde291"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.