SB2026090432 - Memory corruption in Linux kernel thunderbolt driver

Description

This security bulletin contains information about 1 vulnerability.

1) Memory corruption (CVE-ID: CVE-2026-80736)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause incorrect DisplayPort bandwidth reservation accounting.

The vulnerability exists due to an out-of-bounds array access in tb_consumed_dp_bandwidth() when processing a bandwidth group with ID MAX_GROUPS. An attacker with physical access can trigger processing of the maximum valid group ID to cause incorrect DisplayPort bandwidth reservation accounting.

Group ID 0 is reserved, while valid group IDs range from 1 through MAX_GROUPS.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0a8c9ed4f166216642a8c084f0de415169c88088
• https://git.kernel.org/stable/c/0bfb67ba366cd68d1d0ad935760577bae1d5df27
• https://git.kernel.org/stable/c/9977321835c7ae71d12a43bed7baa5bd514d01c3
• https://git.kernel.org/stable/c/d2ee4d47aacbd2ba456092eeec670dba35fde291