Bandwidth Group Reservation Vulnerability in Linux Kernel

CVE-2026-80736

What is CVE-2026-80736?

A vulnerability in the Linux kernel's handling of bandwidth group reservations has been identified, stemming from improper indexing of the group ID. Valid group IDs should range from 1 to MAX_GROUPS, while group ID 0 is reserved. The current implementation causes tb_consumed_dp_bandwidth() to index its local group_reserved[] array improperly, allowing access to one element beyond the allocated entries. This situation excludes the last group's reserved bandwidth from being included in the final calculations. To resolve this, the local array should be expanded to include MAX_GROUPS + 1 entries, ensuring that both the reserved ID 0 and all valid IDs from 1 to MAX_GROUPS are correctly accounted for.

References