CVE-2026-80990: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80990 Overview

CVE-2026-80990 is a resource leak vulnerability in the Linux kernel's Thunderbolt networking driver (net: thunderbolt). The flaw resides in the tbnet_connected_work() function, which fails to release a receive HopID that was allocated by tb_xdomain_alloc_in_hopid() when the returned identifier does not match the requested one. Because the allocator returns the next free HopID above the requested lower bound instead of failing, the mismatch path leaks the allocation for the lifetime of the XDomain connection.

Critical Impact
A resource leak in Thunderbolt XDomain networking exhausts HopID allocations over repeated connection attempts, degrading availability of Thunderbolt peer-to-peer network links.

Affected Products

Linux kernel with Thunderbolt networking (drivers/net/thunderbolt) enabled
Multiple stable kernel branches referenced by the upstream fix commits
Systems using Thunderbolt XDomain peer networking

Discovery Timeline

2026-09-11 - CVE-2026-80990 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80990

Vulnerability Analysis

The Thunderbolt network driver establishes peer-to-peer links between hosts using XDomain paths identified by HopIDs. During connection setup, tbnet_connected_work() calls tb_xdomain_alloc_in_hopid() to reserve the peer's transmit path ID on the receive side. The allocator uses the requested value as the lower bound to ida_alloc_range(), so a taken ID does not cause failure — instead, the next free ID above the request is returned.

The caller treats any returned ID other than the requested one as a failure and exits without releasing the allocated identifier. The reserved HopID then remains marked as in-use for the remainder of the XDomain connection with no reference held to free it later. Repeated mismatched connection attempts progressively exhaust the HopID pool.

Root Cause

The root cause is a missing resource release on an error path. The function correctly releases the HopID in its normal error unwind at the end of execution but omits the equivalent cleanup when the allocator returns a non-matching identifier. This is a classic memory leak pattern applied to an integer ID allocator (ida).

Attack Vector

The issue requires an attached Thunderbolt peer and repeated XDomain connection cycles that trigger HopID mismatches. It is a local availability defect rather than a remotely reachable attack surface, and there are no known exploits or CISA KEV listings for this CVE. Exploitation potential is limited to local users capable of connecting Thunderbolt devices.

No verified exploit code is available. See the upstream fix commits for the exact patch: Kernel Commit 1c361f6 and Kernel Commit 47981eb.

Detection Methods for CVE-2026-80990

Indicators of Compromise

Repeated Thunderbolt XDomain connection failures logged by thunderbolt and thunderbolt-net kernel modules
Growing count of allocated HopIDs visible in Thunderbolt debugfs entries with no corresponding active connections
Failed tb_xdomain_alloc_in_hopid() allocations returning -ENOSPC after extended uptime

Detection Strategies

Audit installed kernel versions against the fixed builds referenced in the upstream stable commits
Monitor kernel logs for thunderbolt-net connection setup failures correlated with Thunderbolt device attach events
Track HopID allocation counts on hosts that regularly use Thunderbolt networking with external peers

Monitoring Recommendations

Collect dmesg output filtered for thunderbolt and tbnet subsystems into a central log store
Alert on kernel version drift across fleet endpoints that expose Thunderbolt ports
Include Thunderbolt driver telemetry in endpoint health checks for developer laptops and workstations

How to Mitigate CVE-2026-80990

Immediate Actions Required

Update to a Linux kernel that includes the referenced stable commits fixing tbnet_connected_work()
Restrict Thunderbolt device authorization on systems that do not require XDomain networking
Reboot systems exhibiting HopID exhaustion to reset allocator state until patched kernels are deployed

Patch Information

The fix releases the HopID when the allocator returns an identifier different from the one requested, mirroring the existing error-unwind cleanup. Backports are available across multiple stable branches. Reference commits: 1c361f6, 2f14635, 47981eb, 61ff3c3, and 9eac181.

Workarounds

Disable the thunderbolt-net kernel module on systems that do not use Thunderbolt IP networking
Configure Thunderbolt security level to require user authorization for new device attachments
Avoid repeated XDomain reconnection cycles on unpatched hosts to slow HopID exhaustion

bash

# Disable thunderbolt-net module until patched kernel is installed
sudo modprobe -r thunderbolt_net
echo 'blacklist thunderbolt_net' | sudo tee /etc/modprobe.d/blacklist-thunderbolt-net.conf