VulnerabilityPublished 11 Sep 2026Updated 30 Oct 2026

CVE-2026-80990: Linux kernel · net: thunderbolt: Release the Rx HopID that was handed out on mismatch

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in b098f01638a142afbb1e00b323e2fc40f237907a : update Linux kernel when convenient.

Data as of 30 Oct 2026, 13:05 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in b098f01638a142afbb1e00b323e2fc40f237907a, 47981eb66461ba4e74bbaea0f139adaaeb3991e9, 61ff3c353e5d2ff4eb9d0b6d8d9e47805b136eea +3

Exploitation evidence

Disclosed: evidence found.
CVE published 11 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 180b0689425c6fb2b35e69a3316ee38371a782df, < b098f01638a142afbb1e00b323e2fc40f237907a	Fixed in b098f01638a142afbb1e00b323e2fc40f237907a
LinuxLinux	Affected ≥ 180b0689425c6fb2b35e69a3316ee38371a782df, < 47981eb66461ba4e74bbaea0f139adaaeb3991e9	Fixed in 47981eb66461ba4e74bbaea0f139adaaeb3991e9
LinuxLinux	Affected ≥ 180b0689425c6fb2b35e69a3316ee38371a782df, < 61ff3c353e5d2ff4eb9d0b6d8d9e47805b136eea	Fixed in 61ff3c353e5d2ff4eb9d0b6d8d9e47805b136eea
LinuxLinux	Affected ≥ 180b0689425c6fb2b35e69a3316ee38371a782df, < 9eac1817bfc5fa76e3a2d1b8fd824cc6ef5a9ab0	Fixed in 9eac1817bfc5fa76e3a2d1b8fd824cc6ef5a9ab0
LinuxLinux	Affected ≥ 180b0689425c6fb2b35e69a3316ee38371a782df, < 2f1463554d0561a2fead81e3888604e5c1125e29	Fixed in 2f1463554d0561a2fead81e3888604e5c1125e29
LinuxLinux	Affected ≥ 180b0689425c6fb2b35e69a3316ee38371a782df, < 1c361f6cf39be7cc0ce37c0b67bd1cdf74b0a0c1	Fixed in 1c361f6cf39be7cc0ce37c0b67bd1cdf74b0a0c1

AI-suggested

A fix is available and has been applied in the Linux kernel. Users and administrators should update to the fixed kernel versions containing the patch identified by the provided commit hashes. No additional mitigation actions are specified or required.

Description

A resource management vulnerability in the Linux kernel's Thunderbolt networking code (net: thunderbolt) was fixed. The issue involved the improper release of a received HopID when a mismatch occurred during allocation, causing the allocation to remain live without a reference. This could lead to resource leakage during XDomain connections. The fix ensures that the HopID is properly released when it does not match the expected value.

Impact

The vulnerability causes a resource leak in the Linux kernel's Thunderbolt networking code, potentially leading to exhaustion of HopID allocations during XDomain connections. There is no indication of direct security compromise such as privilege escalation or denial of service beyond resource leakage. No known exploits in the wild have been reported.

Summary

CVE-2026-80990 addresses a flaw in the Linux kernel's Thunderbolt networking subsystem where tb_xdomain_alloc_in_hopid() passes a desired HopID to ida_alloc_range() as a lower bound, allowing the allocator to return the next free ID above it. The function tbnet_connected_work() expects the peer's transmit path HopID and treats any other ID as a failure, returning without releasing the allocated ID. This causes the allocation to remain live for the duration of the XDomain connection without any reference holding it, leading to a resource leak. The patch releases the allocated HopID when it does not match the requested one, mirroring the error unwind behavior that releases the expected ID.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Oct 2026, 13:05 UTC

Technical details

References

Community reviews

Related threats