CVE-2026-80736

A flaw was found in the Linux kernel's Thunderbolt driver. The tb_consumed_dp_bandwidth() function attempts to access an array beyond its allocated memory, specifically when handling bandwidth group IDs. This out-of-bounds read can lead to an incorrect calculation of reserved bandwidth for Thunderbolt devices, potentially affecting system stability or resource allocation.

An off by one out of bounds access can occur in the Thunderbolt DisplayPort bandwidth accounting path because valid bandwidth group IDs are 1 through MAX_GROUPS while group_reserved was allocated with only MAX_GROUPS entries. When group ID MAX_GROUPS is used as a direct array index, tb_consumed_dp_bandwidth can access one element past the local array and may corrupt adjacent stack state or compute reserved bandwidth incorrectly. For the CVSS the PR:N is used because a physical attacker with a crafted or specific Thunderbolt setup does not need a local account on the target system. The issue is not network reachable and normally requires physical access to Thunderbolt or USB4 DisplayPort tunneling hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.