HIGH Introduced in 6.9
thunderbolt BandwidthGroup OOB
CVE-2026-80736
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth group reservation indexing Valid bandwidth group IDs range from 1 through MAX_GROUPS, while Group ID 0 is reserved. tb_consumed_dp_bandwidth() uses the Group ID directly to index its local group_reserved[] array. The array currently has MAX_GROUPS entries, so its valid indices are 0 through MAX_GROUPS - 1. Group ID MAX_GROUPS therefore accesses one element past the end, and the final group's reserved bandwidth is not included when the array is summed. Give group_reserved[] MAX_GROUPS + 1 entries so direct Group ID indexing covers the reserved ID 0 and valid IDs 1 through MAX_GROUPS.
02KernelScan AI Analysis
Risk summary
A stack-based out-of-bounds write exists in the Thunderbolt driver's DisplayPort bandwidth management code. An attacker who can physically connect a Thunderbolt or USB4 device reporting the maximum valid group ID triggers a one-element-past-end write on a stack-allocated array, potentially corrupting adjacent stack data and leading to kernel crash or code execution.
Vulnerability analysis
A stack buffer in the Thunderbolt DisplayPort bandwidth tracking logic is one entry too small. When a connected device uses the highest valid group identifier, the driver writes just past the end of that buffer, corrupting nearby stack data. The correction increases the buffer size by one entry so every valid identifier, including the highest one, fits safely. An attacker can trigger the flaw by physically connecting a Thunderbolt or USB4 device that reports the maximum group identifier; no software privileges are needed.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.1 | 6.9 | 7.1.9 | 0a8c9ed4f166 |
| 6.12 | 6.9 | 6.12.104 | 0bfb67ba366c |
| 6.18 | 6.9 | 6.18.45 | 9977321835c7 |
| mainline | 6.9 | 7.2 | d2ee4d47aacb |
| cip/6.12 | 6.9 | 6.12.104-cip30 | 0bfb67ba366c |