CVE-2026-80987: Linux Kernel NTB Information Disclosure

CVE-2026-80987 Overview

CVE-2026-80987 is a Linux kernel vulnerability in the Non-Transparent Bridge (NTB) transport subsystem. The flaw resides in ntb_process_tx(), which mishandles oversized transmit buffers by invoking tx_handler() with a NULL data pointer while returning success. The ntb_netdev driver never frees the associated socket buffer (skb) and never enters its enqueue error path, leaking kernel memory on every oversized transmission. Repeated exposure to oversized packets can exhaust kernel memory and destabilize the host. The upstream fix rejects oversized buffers in ntb_transport_tx_enqueue() before a queue entry is acquired and returns -EMSGSIZE, leaving buffer ownership with the caller.

Critical Impact
Repeated triggering of the oversized buffer path can exhaust kernel memory through leaked skb allocations, leading to denial of service on affected Linux systems using the NTB transport subsystem.

Affected Products

Linux kernel ntb_transport module (multiple stable branches referenced by upstream commits)
Linux kernel ntb_netdev driver dependent on ntb_transport_tx_enqueue()
Systems using PCIe Non-Transparent Bridge networking between hosts

Discovery Timeline

2026-09-11 - CVE-2026-80987 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80987

Vulnerability Analysis

The defect lies in the transmit path of the Linux kernel NTB transport layer. When ntb_process_tx() receives a buffer larger than the negotiated maximum transfer size, the function invokes the registered tx_handler() callback with a NULL data pointer and returns a success status. This success signal misleads the calling driver about the true outcome of the enqueue attempt.

In ntb_netdev, the completion callback interprets the NULL-pointer invocation as a non-actionable event and skips the branch that frees the skb. The enqueue error path is likewise never taken because the underlying call reported success. The skb remains allocated with no remaining reference to release it, producing a persistent kernel memory leak per oversized packet.

The patch relocates the size check to ntb_transport_tx_enqueue(), evaluating the buffer length before a queue entry is claimed. Oversized buffers now yield -EMSGSIZE, and the caller retains ownership so it can free the skb deterministically. This resolves the semantic mismatch between the transport layer and the netdev consumer.

Root Cause

The root cause is a Memory Leak driven by an inconsistent return contract. ntb_process_tx() returned success on an error condition, breaking the caller assumption that success implies transport ownership of the buffer. Neither the completion path nor the error path in ntb_netdev freed the skb, resulting in unbounded accumulation of leaked kernel buffers under repeated oversized transmissions.

Attack Vector

The advisory records a Network attack vector with high impact to availability and no impact to confidentiality or integrity. An attacker or misbehaving peer that can cause oversized frames to be enqueued through the NTB transport path triggers a memory leak on each attempt. Sustained triggering exhausts kernel memory and produces a denial of service on the affected host. Exploitation requires the NTB transport and ntb_netdev stack to be in use.

No public exploit code is referenced in the enriched data. See the upstream fix at Kernel Commit 4890152 and the additional stable backports listed in the references for the code-level change.

Detection Methods for CVE-2026-80987

Indicators of Compromise

Progressive growth in kernel slab consumption attributable to skb allocations on hosts using ntb_netdev.
Kernel log entries or warnings related to ntb_transport transmit failures without corresponding buffer frees.
Increasing memory pressure or oom-kill events on NTB-connected systems processing external traffic.

Detection Strategies

Compare running kernel version against the fixed commits referenced in the NVD entry to identify unpatched hosts.
Monitor /proc/slabinfo and /proc/meminfo for anomalous skbuff_head_cache growth over time on NTB-enabled systems.
Instrument the ntb_transport_tx_enqueue() and ntb_process_tx() code paths with ftrace or bpftrace to observe return codes and buffer sizes during transmit.

Monitoring Recommendations

Alert on sustained kernel memory growth on hosts that load the ntb_transport or ntb_netdev modules.
Ingest dmesg and journal output into a centralized log platform and search for NTB transport anomalies.
Track kernel package versions across the fleet and flag systems missing the referenced stable backports.

How to Mitigate CVE-2026-80987

Immediate Actions Required

Apply the vendor kernel update that incorporates the upstream fix rejecting oversized TX buffers in ntb_transport_tx_enqueue().
Inventory hosts that load ntb_transport and ntb_netdev and prioritize patching for systems exposed to untrusted NTB peers.
Reboot patched hosts so the corrected transport module is active in the running kernel.

Patch Information

The fix is available in the Linux stable tree across multiple branches. Reference commits include Kernel Commit 4890152, Kernel Commit 668aa32, Kernel Commit 6b6bbc6, Kernel Commit 75a604e, Kernel Commit 9b0fa8a, Kernel Commit a4f2387, Kernel Commit a7f2210, and Kernel Commit b6db88c. Consume the patch through your distribution's kernel update channel where possible.

Workarounds

Unload the ntb_netdev and ntb_transport modules on hosts that do not require NTB networking until a patched kernel is deployed.
Restrict NTB connectivity to trusted peers and constrain peer MTU to values within the negotiated transport limit.
Monitor kernel memory usage and schedule reboots to reclaim leaked memory on systems that cannot be immediately patched.

bash

# Configuration example: verify and, if needed, temporarily unload NTB modules
lsmod | grep -E 'ntb_transport|ntb_netdev'
sudo modprobe -r ntb_netdev
sudo modprobe -r ntb_transport