CVE-2026-80990

net: thunderbolt: Release the Rx HopID that was handed out on mismatch

State: Published
Severity: Not scored
Published: Sep 11, 2026
Updated: Oct 30, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: thunderbolt: Release the Rx HopID that was handed out on mismatch

tb_xdomain_alloc_in_hopid() passes the wanted HopID to ida_alloc_range() as the lower bound, so a taken id is not an error there: the allocator returns the next free one above it. tbnet_connected_work() asks for the peer's transmit path, treats any other id as a failure and returns without releasing what it got, so that allocation stays live for the rest of the XDomain connection with nothing left holding a reference to it.

Release the id when it is not the one we asked for, the same way the error unwind at the end of the function releases the expected one.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	180b0689425c6fb2b35e69a3316ee38371a782df to before b098f01638a142afbb1e00b323e2fc40f237907aAffected 180b0689425c6fb2b35e69a3316ee38371a782df to before 47981eb66461ba4e74bbaea0f139adaaeb3991e9Affected 180b0689425c6fb2b35e69a3316ee38371a782df to before 9eac1817bfc5fa76e3a2d1b8fd824cc6ef5a9ab0Affected 180b0689425c6fb2b35e69a3316ee38371a782df to before 61ff3c353e5d2ff4eb9d0b6d8d9e47805b136eeaAffected 180b0689425c6fb2b35e69a3316ee38371a782df to before 1c361f6cf39be7cc0ce37c0b67bd1cdf74b0a0c1Affected 180b0689425c6fb2b35e69a3316ee38371a782df to before 2f1463554d0561a2fead81e3888604e5c1125e29Affected
LinuxLinux	5.13Affected before 5.13Not affected 6.1.191 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

180b0689425c6fb2b35e69a3316ee38371a782df to before b098f01638a142afbb1e00b323e2fc40f237907aAffected
180b0689425c6fb2b35e69a3316ee38371a782df to before 47981eb66461ba4e74bbaea0f139adaaeb3991e9Affected
180b0689425c6fb2b35e69a3316ee38371a782df to before 9eac1817bfc5fa76e3a2d1b8fd824cc6ef5a9ab0Affected
180b0689425c6fb2b35e69a3316ee38371a782df to before 61ff3c353e5d2ff4eb9d0b6d8d9e47805b136eeaAffected
180b0689425c6fb2b35e69a3316ee38371a782df to before 1c361f6cf39be7cc0ce37c0b67bd1cdf74b0a0c1Affected
180b0689425c6fb2b35e69a3316ee38371a782df to before 2f1463554d0561a2fead81e3888604e5c1125e29Affected

LinuxLinux

5.13Affected
before 5.13Not affected
6.1.191 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.