CVE-2026-80736

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the thunderbolt component where the tb consumed dp bandwidth() function uses a Group ID directly to index the group reserved[] array. Because the array only contains MAX GROUPS entries (indices 0 through MAX GROUPS - 1) and valid Group IDs range from 1 through MAX GROUPS, a Group ID equal to MAX GROUPS results in an out-of-bounds access. This causes the reserved bandwidth of the final group to be excluded during summation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.