Linux Kernel Thunderbolt Bandwidth Group Array Index Out of Bounds

CVE-2026-80736 is an array indexing vulnerability in the Linux kernel's Thunderbolt subsystem that exposes a classic off-by-one error in bandwidth group reservation management. The vulnerability occurs when bandwidth group IDs (which range from 1 to MAX_GROUPS) are used directly as array indices without proper bounds checking against the group_reserved[] array, which only has MAX_GROUPS entries with valid indices 0 through MAX_GROUPS-1. This allows Group ID MAX_GROUPS to access memory one element past the allocated array, potentially leading to information disclosure, denial of service, or memory corruption. Any system running the affected Linux kernel version with Thunderbolt functionality enabled is vulnerable, particularly affecting laptops, docking stations, and devices that rely on Thunderbolt connectivity for high-speed data transfer.

While CVE-2026-80736 lacks explicit MITRE ATT&CK mapping, Casky's security skill framework would identify the underlying vulnerability patterns through Claude's extended reasoning capabilities. A practitioner using Casky would observe detection signals aligned with T1190 (Exploit Public-Facing Application) and T1499 (Endpoint Denial of Service) techniques, as this memory safety issue can be triggered through malformed Thunderbolt device interactions or crafted resource reservation requests. The platform's 754 mapped security skills would highlight improper input validation, memory bounds checking failures, and kernel-level resource management weaknesses—patterns commonly associated with CWE-129 (Improper Validation of Array Index) vulnerabilities. Practitioners would see findings related to kernel fuzzing results, static analysis warnings about array access, and runtime memory protection bypass indicators, enabling proactive patching before exploitation occurs.