Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth group reservation indexing Valid bandwidth group IDs range from 1 through MAX_GROUPS, while Group ID 0 is reserved. tb_consumed_dp_bandwidth() uses the Group ID directly to index its local group_reserved[] array. The array currently has MAX_GROUPS entries, so its valid indices are 0 through MAX_GROUPS - 1. Group ID MAX_GROUPS therefore accesses one element past the end, and the final group's reserved bandwidth is not included when the array is summed. Give group_reserved[] MAX_GROUPS + 1 entries so direct Group ID indexing covers the reserved ID 0 and valid IDs 1 through MAX_GROUPS.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-03T13:06:12.480Z",
  "pubdate": "2026-09-03T13:06:12.480Z",
  "executiveSummary": "This vulnerability is an out-of-bounds (OOB) memory access issue within the Linux kernel's Thunderbolt subsystem, specifically affecting the bandwidth management logic.\nThe flaw originates from an off-by-one error when indexing the group_reserved[] array using bandwidth group IDs. Because the array size does not account for the maximum possible group ID, the kernel attempts to access memory outside the bounds of the allocated structure.\nThe vulnerability allows for memory corruption or information leakage, as the kernel reads from or potentially writes to an adjacent memory location on the heap when processing group bandwidth.\nThis issue affects systems utilizing the Thunderbolt driver stack. While exploitation likely requires local access or the ability to influence kernel-level Thunderbolt data structures, it represents a significant stability and security risk. Successful exploitation could lead to kernel panics (denial of service) or potentially arbitrary code execution if an attacker can manipulate the adjacent memory contents.\nThe vulnerability is primarily a logic error in resource accounting, requiring no specialized network conditions, but rather specific kernel state transitions related to DisplayPort (DP) bandwidth configuration.",
  "technicalDetails": "The vulnerability resides in the tb_consumed_dp_bandwidth() function within the Linux kernel's Thunderbolt driver. The function is responsible for calculating reserved bandwidth by iterating through an internal array, group_reserved[].\nThe root cause is an improper array dimensioning issue relative to the group ID indexing schema. Thunderbolt bandwidth group IDs are defined as a range from 1 to MAX_GROUPS, with 0 reserved. However, the internal implementation defines the size of group_reserved[] as MAX_GROUPS. In C-based array indexing, an array of size N has valid indices from 0 to N-1.\nConsequently, when a caller provides a group ID equal to MAX_GROUPS, the expression group_reserved[MAX_GROUPS] results in an out-of-bounds access. The memory accessed is one element past the allocated block of the group_reserved[] array.\nThe exploitation flow begins when the kernel processes DisplayPort bandwidth consumption. An attacker who can trigger the configuration of a bandwidth group with the ID corresponding to MAX_GROUPS will force the kernel to access this out-of-bounds memory address during the summation process in tb_consumed_dp_bandwidth().\nBecause the summation logic reads the value at the OOB location, the kernel may incorporate unintended heap data into its bandwidth calculations. If this value is subsequently used in hardware programming registers or further logic gates, it may lead to incorrect bandwidth allocation, which could be leveraged to cause memory corruption in related structures.\nFurthermore, since the kernel is reading from an uninitialized or unexpected heap area, this represents a potential information disclosure vulnerability. If an attacker can control the contents of the memory immediately following the group_reserved[] array, they may influence the return value of the bandwidth calculation, potentially bypassing security checks or causing an invalid system state.\nThis vulnerability is exacerbated by the lack of input validation or bounds checking for the group ID index before it is used to dereference the array. The failure to handle the maximum index correctly causes a logic error that propagates throughout the bandwidth management subsystem, potentially causing a system crash via a kernel panic if the OOB access triggers a page fault in a protected memory segment."
}