CVE-2026-80736 in Linux
Summary
by MITRE • 09/03/2026
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Fix bandwidth group reservation indexing
Valid bandwidth group IDs range from 1 through MAX_GROUPS, while Group ID 0 is reserved. tb_consumed_dp_bandwidth() uses the Group ID directly to index its local group_reserved[] array.
The array currently has MAX_GROUPS entries, so its valid indices are 0 through MAX_GROUPS - 1. Group ID MAX_GROUPS therefore accesses one element past the end, and the final group's reserved bandwidth is not included when the array is summed.
Give group_reserved[] MAX_GROUPS + 1 entries so direct Group ID
indexing covers the reserved ID 0 and valid IDs 1 through MAX_GROUPS.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/03/2026
The Thunderbolt controller driver in the Linux kernel contains a critical off-by-one error within its bandwidth management subsystem, specifically affecting how display port bandwidth reservations are tracked for connected devices. This vulnerability arises from an inconsistency between the logical grouping of device resources and the physical allocation of memory arrays used to track those resources. The Thunderbolt specification defines bandwidth groups where valid identifiers range from one up to a maximum limit defined as MAX_GROUPS, while group identifier zero is explicitly reserved for internal use or null operations. However, the function tb_consumed_dp_bandwidth(), which calculates total consumed display port bandwidth by summing values in the local group_reserved array, utilizes these raw Group IDs directly as indices into that array without any offset adjustment.
The core technical flaw lies in the size of the group_reserved array relative to the range of valid identifiers it must support. The array was allocated with exactly MAX_GROUPS entries, which mathematically provides indexable positions from zero through MAX_GROUPS minus one. Because Group ID MAX_GROUPS is a valid identifier for an active bandwidth group, attempting to access this specific index results in writing or reading memory beyond the bounds of the allocated buffer. This constitutes a classic out-of-bounds write vulnerability that falls under CWE-787: Out-of-Bounds Write and CWE-193: Off-by-One Error. The immediate operational consequence is twofold: first, it introduces potential memory corruption risks if the adjacent memory contains sensitive data or control structures, potentially leading to kernel panics or privilege escalation depending on heap layout; second, even in cases where no crash occurs due to safe memory boundaries, the logic fails because the final group's reserved bandwidth is excluded from summation calculations.
This exclusion of the highest-numbered group’s bandwidth leads to inaccurate accounting of available resources within the Thunderbolt domain controller. Accurate bandwidth reservation is essential for maintaining stable video output and data transfer rates on high-speed peripherals connected via Thunderbolt interfaces. When the system underestimates consumed bandwidth due to this indexing error, it may incorrectly permit additional connections or higher resolution settings than the physical hardware can sustainably support. This discrepancy can manifest as visual artifacts, dropped frames, intermittent connection drops, or complete failure of display output for devices attached in the highest priority group slot. Such instability undermines the reliability guarantees expected from certified Thunderbolt peripherals and degrades user experience significantly during intensive multimedia tasks.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability represents an opportunity for local attackers to exploit memory corruption primitives if they can influence which bandwidth groups are active or manipulate device attachment sequences to trigger the out-of-bounds access repeatedly. While primarily a stability issue rather than a direct remote code execution vector in most configurations, improper kernel heap management remains a foundational precursor to more severe exploits involving arbitrary read/write capabilities. The lack of bounds checking before array indexing highlights a deficiency in defensive programming practices within this subsystem, emphasizing the need for rigorous validation of input parameters derived from hardware specifications against allocated buffer sizes.
Mitigation strategies primarily involve applying the upstream Linux kernel patch that corrects the allocation size by increasing group_reserved to hold MAX_GROUPS plus one elements. This adjustment ensures that index zero remains available for reserved purposes while indices one through MAX_GROUPS map correctly to valid bandwidth groups without exceeding memory boundaries. System administrators should ensure their distributions include this specific fix, particularly those running kernels with Thunderbolt support enabled and active display port connections. For developers maintaining custom kernel builds or out-of-tree modules interacting with the Thunderbolt subsystem, it is imperative to verify that any wrapper functions performing similar indexing operations implement explicit bounds checks before accessing resource tracking arrays. Regular security audits focusing on array index calculations against hardware-defined limits are recommended to prevent recurrence of such off-by-one errors in other driver components.