CVE-2026-80736

CVE-2026-80736 is an off-by-one indexing flaw in the Linux kernel's Thunderbolt/USB4 driver: tb_consumed_dp_bandwidth() uses bandwidth group IDs (valid range 1 through MAX_GROUPS) to directly index a group_reserved[] array that only has MAX_GROUPS entries, so a group whose ID equals MAX_GROUPS accesses one element past the end of the array. It is triggered when the driver computes consumed DisplayPort bandwidth for a system using bandwidth groups, and the same bug also omits the final group's reserved bandwidth from the summed total, potentially corrupting the driver's bandwidth reservation accounting. Per the assigned CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, rated 7.8 high), a local low-privileged attacker could potentially gain information disclosure, memory corruption, or denial of service, though this is a one-element indexing error and no exploit details are published. Any Linux system running a kernel with the affected Thunderbolt/USB4 DisplayPort bandwidth-group code (i.e., hosts with Thunderbolt or USB4 controllers) is affected; specific vulnerable and fixed kernel version ranges were not provided in the available data. There is no known public proof of concept, the issue is not in CISA's KEV, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days, so no in-the-wild exploitation is known.

What to do: Install a kernel update containing the backported thunderbolt fix once your distribution publishes one (the patch resizes group_reserved[] to MAX_GROUPS + 1); the available data does not name specific fixed versions, so track your vendor's kernel security advisory. As an interim measure, limit untrusted local accounts on systems that actively use Thunderbolt/USB4 DisplayPort tunneling, as no other workaround is documented.