Executive brief
The Linux kernel's Thunderbolt driver incorrectly manages DisplayPort bandwidth reservation group indexing, causing the final bandwidth group's reservation data to be excluded from calculations. This memory indexing bug could lead to incorrect bandwidth allocation decisions for Thunderbolt devices, potentially causing performance degradation or service failures in systems relying on proper DisplayPort bandwidth management.
Technical details
The vulnerability is an off-by-one array indexing error in the tb_consumed_dp_bandwidth() function within drivers/thunderbolt/tb.c. Valid bandwidth group IDs range from 1 through MAX_GROUPS, while group ID 0 is reserved. The group_reserved[] array was sized with MAX_GROUPS entries (indices 0 to MAX_GROUPS-1), allowing group ID MAX_GROUPS to access memory one element past the end of the array. This causes incomplete bandwidth tracking where the final group's reserved bandwidth is not included in the sum. The fix increases the array size to MAX_GROUPS + 1 to accommodate direct indexing by group IDs. No active exploitation in the wild has been reported, though the impact could affect Thunderbolt/DisplayPort bandwidth management on affected systems.
Affected products
- Linux Linux Kernel multiple versions (patch available in stable series)
Timeline
- 2026-09-03: disclosed
- 2026-08-19: patched