Executive brief
The Linux kernel's NTB (Non-Transparent Bridge) network device driver has a flaw in its receive packet handling that causes the RX queue to gradually empty when memory allocation fails. If memory is unavailable during receive processing, packets are dropped without being requeued, and the interface eventually stops receiving data even after memory becomes available again. This can disrupt NTB virtual network connectivity used in server interconnects.
Technical details
The vulnerability exists in the ntb_netdev_rx_handler() function in drivers/net/ntb_netdev.c. The root cause is that the handler delivers received socket buffers (skbs) to the network stack before allocating replacement buffers. If the netdev_alloc_skb() call for the replacement buffer fails, no buffer is reposted to the NTB transport queue, permanently reducing queue depth. With repeated allocation failures under memory pressure, the queue is progressively depleted, eventually causing reception to stall. The driver lacks a retry mechanism to refill the queue. The fix allocates the replacement buffer before passing the received packet to the stack; if allocation fails, the original buffer is reposted instead. This preserves queue depth and allows reception to resume once memory is available. The patch affects all Linux kernel versions supporting the NTB netdev feature.
Affected products
- Linux Linux kernel All versions with NTB netdev support (affected commit 548c237c0a99 and later)
Timeline
- 2026-08-22: disclosed
- 2026-08-27: patched