CVE-2026-80736 thunderbolt: Fix bandwidth group reservation indexing
An out-of-bounds read in the Linux kernel Thunderbolt driver can cause incorrect bandwidth accounting, potentially leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80736?
CVE-2026-80736 is a high-severity vulnerability in Linux, published on 3 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Fix bandwidth group reservation indexing
Valid bandwidth group IDs range from 1 through MAX_GROUPS, while Group ID 0 is reserved. tb_consumed_dp_bandwidth() uses the Group ID directly to index its local group_reserved[] array.
The array currently has MAX_GROUPS entries, so its valid indices are 0 through MAX_GROUPS - 1. Group ID MAX_GROUPS therefore accesses one element past the end, and the final group's reserved bandwidth is not included when the array is summed.
Give group_reserved[] MAX_GROUPS + 1 entries so direct Group ID indexing covers the reserved ID 0 and valid IDs 1 through MAX_GROUPS.
Which versions are affected by CVE-2026-80736?
How do I fix CVE-2026-80736?
Apply the vendor's patch.
Is CVE-2026-80736 being exploited?
There is no known exploitation of CVE-2026-80736 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80736, DEBIAN-CVE-2026-80736, GHSA-g6c9-vf65-gggg, UBUNTU-CVE-2026-80736.