CVE-2026-80988: Linux Kernel NTB Transport Race Condition

CVE-2026-80988 Overview

CVE-2026-80988 is a memory leak vulnerability in the Linux kernel's Non-Transparent Bridge (NTB) transport layer. The flaw exists in the ntb_transport_tx_enqueue() function, which incorrectly returns success (0) when dropping packets during a queue pair (QP) link-down condition. This violates the function's contract, causing ntb_netdev to report NETDEV_TX_OK and abandon the socket buffer (skb) without freeing it. Every transmit attempt that races with a link-down event leaks one skb, producing progressive kernel memory exhaustion on affected systems using NTB networking.

Critical Impact
Each TX enqueue racing with a QP link-down leaks a socket buffer, leading to unbounded kernel memory consumption and potential denial of service on Linux systems using NTB-based networking.

Affected Products

Linux kernel versions containing commit f195a1a6fe41 ("ntb: Drop packets when qp link is down") prior to the fix
Linux kernel NTB (Non-Transparent Bridge) transport subsystem
ntb_netdev network driver relying on ntb_transport_tx_enqueue()

Discovery Timeline

2026-09-11 - CVE-2026-80988 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80988

Vulnerability Analysis

The Linux kernel NTB transport layer provides a communication channel between hosts connected through a PCIe non-transparent bridge. The ntb_transport_tx_enqueue() function queues outbound packets onto a queue pair for transmission across the bridge. A prior commit (f195a1a6fe41) introduced logic intended to drop packets submitted while the QP link is down.

The implementation returned 0 on this drop path. By the API contract, a zero return signals successful enqueue and transfers ownership of the buffer from the caller to the transport. The caller, ntb_netdev, treated the packet as accepted and returned NETDEV_TX_OK to the networking stack. Neither side retained a reference to the skb, so nothing freed it.

The result is a per-transmit memory leak whenever a packet races the link-down state. Repeated link flapping under active traffic produces steady kernel memory growth. Over time, this can exhaust available memory and destabilize the host. The fix returns -ENOLINK on the drop path, restoring the contract that a non-zero return leaves the buffer owned by the caller, allowing ntb_netdev to free the skb cleanly.

Root Cause

The root cause is a contract violation between ntb_transport_tx_enqueue() and its callers. The function returned a success code on a code path that did not consume the buffer, breaking the ownership-transfer semantics expected by network driver code.

Attack Vector

Exploitation requires the ability to generate transmit traffic on an NTB-backed network interface while the underlying QP link transitions to a down state. This is primarily a local reliability and resource-exhaustion issue rather than a remote attack surface. Sustained traffic during repeated link flaps causes progressive kernel memory leakage.

No verified proof-of-concept code is publicly available. See the upstream kernel commits referenced by the Linux kernel stable tree for the exact source-level changes.

Detection Methods for CVE-2026-80988

Indicators of Compromise

Steady, unexplained growth in kernel slab memory attributable to skbuff_head_cache on systems using ntb_netdev.
Repeated NTB QP link-state transition messages in dmesg correlated with active network traffic on the NTB interface.
Elevated TX counters on the NTB network interface without corresponding received traffic on the peer.

Detection Strategies

Monitor /proc/slabinfo for anomalous growth in skbuff_head_cache and skbuff_fclone_cache on hosts using NTB transport.
Correlate NTB link-state kernel log events with sustained MemAvailable decline in node telemetry.
Inventory running Linux kernel versions and identify systems loading the ntb_transport and ntb_netdev modules via lsmod.

Monitoring Recommendations

Ingest kernel logs and slab statistics into centralized telemetry pipelines to establish baselines and alert on drift.
Alert when NTB interfaces report frequent link-state changes in short time windows.
Track kernel version and patch level across the fleet to confirm remediation coverage.

How to Mitigate CVE-2026-80988

Immediate Actions Required

Identify all Linux hosts running kernels that include commit f195a1a6fe41 but not the corrective patches referenced in the NVD entry.
Apply the vendor-supplied stable kernel updates that include the -ENOLINK return fix in ntb_transport_tx_enqueue().
On hosts where patching is deferred, minimize NTB link flapping and reboot systems exhibiting sustained kernel memory growth.

Patch Information

The fix is available in multiple Linux stable kernel branches through the following commits: 45cc1103, 5eca0d89, 76c9ccc0, 873ce713, 89177732, 894e136b, 96d792c6, and e6cc541f. See the Linux kernel stable tree commits for the authoritative source changes. Consult your Linux distribution's security advisories for backported kernel packages.

Workarounds

Unload the ntb_netdev and ntb_transport modules on systems that do not require NTB networking (modprobe -r ntb_netdev ntb_transport).
Avoid conditions that induce QP link flaps, such as reloading NTB drivers under active traffic.
Schedule periodic reboots on unpatched hosts to reclaim leaked kernel memory until patching is complete.

bash

# Verify running kernel version and NTB module load status
uname -r
lsmod | grep -E 'ntb_transport|ntb_netdev'

# Unload NTB networking modules if not required
sudo modprobe -r ntb_netdev
sudo modprobe -r ntb_transport

# Monitor skbuff slab caches for leak indicators
sudo grep -E 'skbuff_head_cache|skbuff_fclone_cache' /proc/slabinfo