CVE-2026-80736thunderbolt: Fix bandwidth group reservation indexing
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth group reservation indexing Valid bandwidth group IDs range from 1 through MAX_GROUPS, while Group ID 0 is reserved. tb_consumed_dp_bandwidth() uses the Group ID directly to index its local group_reserved[] array. The array currently has MAX_GROUPS entries, so its valid indices are 0 through MAX_GROUPS - 1. Group ID MAX_GROUPS therefore accesses one element past the end, and the final group's reserved bandwidth is not included when the array is summed. Give group_reserved[] MAX_GROUPS + 1 entries so direct Group ID indexing covers the reserved ID 0 and valid IDs 1 through MAX_GROUPS.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 52a4490e89d7c4effe613d8dffd2ac0a2a786bd7 builds before 0bfb67ba366cd68d1d0ad935760577bae1d5df27; from 52a4490e89d7c4effe613d8dffd2ac0a2a786bd7 before 9977321835c7ae71d12a43bed7baa5bd514d01c3; 52a4490e89d7c4effe613d8dffd2ac0a2a786bd7 builds before 0a8c9ed4f166216642a8c084f0de415169c88088; from 52a4490e89d7c4effe613d8dffd2ac0a2a786bd7 before d2ee4d47aacbd2ba456092eeec670dba35fde291 | CNA record |
References
- https://git.kernel.org/stable/c/0bfb67ba366cd68d1d0ad935760577bae1d5df27
- https://git.kernel.org/stable/c/9977321835c7ae71d12a43bed7baa5bd514d01c3
- https://git.kernel.org/stable/c/0a8c9ed4f166216642a8c084f0de415169c88088
- https://git.kernel.org/stable/c/d2ee4d47aacbd2ba456092eeec670dba35fde291
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.