CVE-2026-80736: thunderbolt: Fix bandwidth group reservation indexing
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Fix bandwidth group reservation indexing
Valid bandwidth group IDs range from 1 through MAXGROUPS, while Group ID 0 is reserved. tbconsumeddpbandwidth() uses the Group ID directly to index its local groupreserved[] array.
The array currently has MAXGROUPS entries, so its valid indices are 0 through MAXGROUPS - 1. Group ID MAXGROUPS therefore accesses one element past the end, and the final group's reserved bandwidth is not included when the array is summed.
Give groupreserved[] MAXGROUPS + 1 entries so direct Group ID indexing covers the reserved ID 0 and valid IDs 1 through MAXGROUPS.
Affected Software
Event History
Frequently Asked Questions
What condition triggers the out-of-bounds access?
The issue is triggered when tb_consumed_dp_bandwidth() processes a valid bandwidth group whose ID equals MAX_GROUPS. That ID is used directly as an index into an array sized only MAX_GROUPS entries, whose highest valid index is MAX_GROUPS - 1.
What is the functional impact besides the out-of-bounds access?
Reserved bandwidth for the final valid bandwidth group is omitted when the group reservation array is summed. This can cause consumed DisplayPort bandwidth accounting to exclude that group's reservation.
Does the reserved group ID 0 cause this issue?
No. Group ID 0 is reserved and fits within the existing array indexing range. The affected case is the highest valid group ID, MAX_GROUPS.