CVE-2026-80736

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The flaw is reached through the local Thunderbolt connection manager control channel (TB_CFG_ERROR_DP_BW notifications into tb_handle_dp_bandwidth_request/tb_alloc_dp_bandwidth), not over IP; on systems with authorized TB docks/workstations, DP bandwidth recalculation can be driven without new network access.

AC:LAttack complexity, low

After an authorized topology uses bandwidth group 7 with reserved DP bandwidth, the out-of-bounds write at group_reserved[7] is deterministic whenever tb_consumed_dp_bandwidth() runs; an attacker can induce the needed bandwidth reductions/mode changes rather than depending on uncontrollable timing.

PR:LPrivileges required, low

The vulnerable path performs no credential checks; once Thunderbolt devices are authorized (common with security level none or boot ACL), an unprivileged local user can trigger DP bandwidth allocation events via display/mode changes that cause DPTX bandwidth notifications.

UI:NUser interaction, none

No victim interaction is required beyond normal authorized Thunderbolt/DisplayPort operation; a local attacker can directly cause the bandwidth-change notifications that reach tb_consumed_dp_bandwidth() without convincing another user to perform a separate action.

S:UScope, unchanged

Impact is kernel stack corruption during Thunderbolt bandwidth accounting in the host kernel; it does not cross a VM/host, IOMMU/DMA, or sandbox security boundary and stays within the same kernel security authority.

C:HConfidentiality impact, high

Indexing group_reserved[] with group ID 7 writes one 32-bit word past a seven-element stack array, corrupting adjacent stack data with attacker-influenced reserved-bandwidth values and enabling kernel memory disclosure primitives.

I:HIntegrity impact, high

This is a kernel stack out-of-bounds write with partially attacker-controlled values (reserved Mb/s), which can corrupt pointers/control data on the stack and be leveraged for arbitrary kernel memory modification or privilege escalation.

A:HAvailability impact, high

Corrupting kernel stack variables in tb_consumed_dp_bandwidth() can cause immediate kernel oops/panic or hang during bandwidth accounting, and unstable stack corruption commonly produces severe system unavailability.