CVE-2026-80990

Received Received - Intake

Thunderbolt Net HopID Leak in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Release the Rx HopID that was handed out on mismatch tb_xdomain_alloc_in_hopid() passes the wanted HopID to ida_alloc_range() as the lower bound, so a taken id is not an error there: the allocator returns the next free one above it. tbnet_connected_work() asks for the peer's transmit path, treats any other id as a failure and returns without releasing what it got, so that allocation stays live for the rest of the XDomain connection with nothing left holding a reference to it. Release the id when it is not the one we asked for, the same way the error unwind at the end of the function releases the expected one.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-80990

EUVD

EUVD-2026-76313

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of a HopID in the Thunderbolt networking subsystem. When a mismatch occurs between the requested and allocated HopID, the allocated ID is not released, causing a resource leak that persists for the duration of the XDomain connection.

Detection Guidance

This vulnerability is specific to the Linux kernel's Thunderbolt networking subsystem. Detection requires checking kernel logs for errors related to HopID allocation in Thunderbolt connections. Monitor logs with: dmesg | grep -i thunderbolt or journalctl -k | grep -i thunderbolt. Look for messages about HopID allocation failures or mismatches.

Impact Analysis

This vulnerability could lead to resource exhaustion on affected systems, potentially causing performance degradation or system instability. It may also create opportunities for further exploitation if the leaked resources are manipulated.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel networking issue without implications for data protection or privacy controls.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this issue. If immediate updating is not possible, disable Thunderbolt networking features if not in use by blacklisting the relevant kernel modules (e.g., modprobe -r thunderbolt).

Hi! I’m here to help you understand CVE-2026-80990. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70