Executive brief
The Linux kernel's NTB (Non-Transparent Bridge) transport layer contained a memory leak when handling oversized network transmission buffers. When an application attempted to send a buffer larger than allowed, the kernel failed to properly release the buffer, causing memory to accumulate over time and potentially exhaust available system memory. This affects systems using NTB technology for inter-device communication, such as specialized PCIe networking hardware.
Technical details
The vulnerability is a resource leak in the ntb_transport driver (drivers/ntb/ntb_transport.c). The root cause is improper error handling in ntb_process_tx() when processing oversized buffers: the function called tx_handler() with a NULL data pointer and returned success, leaving the caller (ntb_netdev) unable to determine whether to free the socket buffer (skb) in its completion callback or take the error path. The fix moves buffer size validation earlier in ntb_transport_tx_enqueue() before queue entry allocation, rejecting oversized buffers with -EMSGSIZE and returning buffer ownership to the caller for proper cleanup. The vulnerability affects NTB devices with network drivers using ntb_transport for transmission, requiring local network activity to trigger the leak.
Affected products
- Linux Linux Kernel Linux kernel versions through 2026-08-17 (patched 2026-09-14)
Timeline
- 2026-09-11: disclosed: CVE-2026-80987 published
- 2026-09-14: patched: Patch merged by Greg Kroah-Hartman
- 2026-08-17: other: Patch authored by Koichiro Den