What is the CVSS score of CVE-2026-80736?

CVE-2026-80736 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-80736?

Linux kernel Thunderbolt driver contains an out-of-bounds memory access flaw enabling local privilege escalation on affected systems.. A patch is available.

How to fix or mitigate CVE-2026-80736?

Within 24 hours, inventory all Linux systems using Thunderbolt hardware support to identify organizational exposure. Within 7 days, apply kernel patches available for stable branches 6.12.x, 6.18.x, 7.1.x, and 7.2-test in non-production environment first given the critical nature of kernel updates. Complete deployment across all affected systems within 30 days and validate Thunderbolt functionality post-patch.

Linux Kernel CVE-2026-80736

EUVD-2026-70340 HIGH

2026-09-03 Linux

GHSA-g6c9-vf65-gggg

Linux Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local access with low privileges needed to reach Thunderbolt code path; OOB write enables full kernel memory corruption triad (C/I/A all High).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.7 MEDIUM

AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 04, 2026 - 05:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Sep 04, 2026 - 05:27 vuln.today

CVSS changed

Sep 04, 2026 - 05:22 NVD

7.8 (HIGH)

Patch available

Sep 03, 2026 - 10:16 EUVD

CVE Published

Sep 03, 2026 - 08:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 03, 2026 - 08:21 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Fix bandwidth group reservation indexing

Valid bandwidth group IDs range from 1 through MAX_GROUPS, while Group ID 0 is reserved. tb_consumed_dp_bandwidth() uses the Group ID directly to index its local group_reserved[] array.

The array currently has MAX_GROUPS entries, so its valid indices are 0 through MAX_GROUPS - 1. Group ID MAX_GROUPS therefore accesses one element past the end, and the final group's reserved bandwidth is not included when the array is summed.

Give group_reserved[] MAX_GROUPS + 1 entries so direct Group ID indexing covers the reserved ID 0 and valid IDs 1 through MAX_GROUPS.

AnalysisAI

Out-of-bounds array access in the Linux kernel's Thunderbolt driver exposes local low-privileged users to potential kernel memory corruption and privilege escalation. The flaw in tb_consumed_dp_bandwidth() sizes the group_reserved[] array at MAX_GROUPS entries (indices 0 through MAX_GROUPS-1) but uses Group IDs directly as indices, where valid IDs run from 1 through MAX_GROUPS - causing an off-by-one that reads and writes one element past the array boundary when the highest bandwidth group is processed. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a local low-privilege account on the target system (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is broadly consistent with a locally-reachable kernel memory corruption primitive, though the full C:H/I:H/A:H triad assumes that the adjacent stack memory can be meaningfully leveraged - which may require further exploit chaining and is not guaranteed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to a patched kernel version: Linux 6.12.104, 6.18.45, 7.1.9, or 7.2, with fixes confirmed at git.kernel.org stable commits (0bfb67ba, 9977321835, 0a8c9ed4, d2ee4d47). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Linux systems using Thunderbolt hardware support to identify organizational exposure. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-80736 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-80736

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code