CVE-2026-80884: Linux Kernel NTB DMA Memory Vulnerability

CVE-2026-80884 Overview

CVE-2026-80884 is a Linux kernel vulnerability in the Non-Transparent Bridge (NTB) subsystem. The flaw involves improper handling of Direct Memory Access (DMA) addresses when releasing allocated memory. The Linux DMA API requires that dma_free_attrs receive the exact dma_handle originally returned by the allocation function. The affected NTB code modified this handle before passing it to the free routine, violating the API contract. The kernel maintainers resolved the issue by storing the original DMA address for future release.

Critical Impact
Improper DMA handle management in the NTB driver can lead to memory management corruption, kernel instability, and potential denial-of-service conditions on affected Linux systems.

Affected Products

Linux Kernel (NTB subsystem)
Systems using Non-Transparent Bridge drivers
Refer to the kernel git commit references for specific affected versions

Discovery Timeline

2026-09-04 - CVE-2026-80884 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80884

Vulnerability Analysis

The vulnerability resides in the Linux kernel's Non-Transparent Bridge (NTB) subsystem, which enables communication between systems across a PCIe bus. The NTB driver allocated DMA memory using the standard kernel DMA API but modified the returned dma_handle before storing it. When the driver later called dma_free_attrs to release the memory, it passed the altered handle rather than the original value returned by the allocation function.

This behavior violates the DMA API contract. The kernel DMA subsystem uses the handle as an opaque token that may encode bus-specific offsets, IOMMU mappings, or architecture-dependent metadata. Modifying the handle breaks the assumptions of the underlying DMA implementation.

The fix stores the original DMA address separately so the driver can pass the unmodified handle to dma_free_attrs when releasing the allocation.

Root Cause

The root cause is improper resource lifecycle management in the NTB driver. The code path did not preserve the original dma_handle returned by the DMA allocation function. This is a driver-level correctness bug that can be classified as improper resource handling and memory management error.

Attack Vector

The attack vector requires local access to a system running the affected NTB driver. Triggering the flawed code path can result in incorrect DMA unmapping operations, corruption of DMA bookkeeping structures, or kernel crashes. Exploitation depends on the system configuration and whether an IOMMU is present. No public exploit is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is available. See the kernel commits 10662aafce4a and da6d997ac556 for technical details of the fix.

Detection Methods for CVE-2026-80884

Indicators of Compromise

Unexpected kernel warnings or oops messages referencing the NTB driver or DMA subsystem in dmesg output.
DMA mapping errors or IOMMU fault messages on systems using Non-Transparent Bridge hardware.
Kernel panics correlated with NTB device initialization, teardown, or hot-unplug events.

Detection Strategies

Inventory Linux systems and identify hosts with NTB-capable PCIe hardware and the ntb kernel module loaded.
Compare running kernel versions against the fixed versions referenced in the upstream kernel git commits.
Enable kernel debug options such as CONFIG_DMA_API_DEBUG in test environments to catch DMA API contract violations.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on NTB or DMA-related warnings.
Track kernel package versions across the fleet and flag hosts running unpatched builds.
Monitor system stability metrics on servers that use NTB for inter-system communication.

How to Mitigate CVE-2026-80884

Immediate Actions Required

Identify systems running affected Linux kernel versions with the NTB subsystem in use.
Apply the upstream kernel patch or update to a distribution kernel that includes the fix.
Prioritize patching on hosts that rely on NTB for production workloads.

Patch Information

The fix is available in the upstream Linux kernel. Review the commits at kernel.org commit 10662aafce4a and kernel.org commit da6d997ac556. The patch modifies the NTB driver to preserve the original dma_handle returned by the allocation function and pass it unmodified to dma_free_attrs. Consult your Linux distribution's security advisories for backported updates.

Workarounds

Unload the ntb kernel module on systems that do not require Non-Transparent Bridge functionality.
Restrict local access to systems where the affected driver is loaded until patches can be applied.
Blacklist NTB-related modules in /etc/modprobe.d/ where the feature is not required.

bash

# Configuration example: verify NTB module status and kernel version
uname -r
lsmod | grep ntb

# Prevent the NTB module from loading until a patched kernel is deployed
echo "blacklist ntb" | sudo tee /etc/modprobe.d/blacklist-ntb.conf
sudo update-initramfs -u