CVE-2026-80987

The Linux kernel's NTB (Non-Transparent Bridge) transport layer mishandles oversized transmit buffers: when ntb_process_tx() receives a buffer larger than the transport queue's payload limit, it invokes the completion handler with a NULL data pointer and reports success, so the ntb_netdev driver neither frees the socket buffer (skb) in its completion callback nor takes its error path, leaking kernel memory. An attacker who can send oversized packets through an ntb_netdev interface can trigger repeated skb leaks, progressively exhausting kernel memory and causing a system-wide denial of service, which matches the CVSS 3.1 score of 7.5 (network vector, no privileges, availability-only impact). Systems affected are those actually using NTB networking via the ntb_transport and ntb_netdev drivers, typically servers, embedded, or industrial platforms bridged with NTB-capable hardware. The upstream fix rejects oversized buffers in ntb_transport_tx_enqueue() with -EMSGSIZE so the caller retains and frees the buffer. No public proof of concept is known and there is no evidence of exploitation in the wild.

What to do: Update to a kernel build containing the upstream fix once your distribution ships it, and monitor distro advisories for the patched package. Check whether you are exposed at all: run 'lsmod | grep ntb' and look for ntb_netdev/ntb_transport interfaces on hosts with NTB-capable hardware. If untrusted traffic can reach an NTB interface, restrict access to it, verify the interface MTU does not exceed the NTB transport's maximum payload, and watch for unexplained kernel memory growth or OOM events.