HIGH Introduced in 3.9
ntb_transport TxBuf Leak
CVE-2026-80987
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI5.2MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: NTB: ntb_transport: Reject oversized TX buffers ntb_process_tx() handles an oversized buffer by calling tx_handler() with a NULL data pointer and returning success. ntb_netdev therefore neither frees the skb in its completion callback nor takes its enqueue error path, leaking it. Reject oversized buffers in ntb_transport_tx_enqueue() before acquiring a queue entry and return -EMSGSIZE. The caller retains ownership of the buffer, and the preceding netdev patch frees the skb when enqueue returns this permanent error.
02KernelScan AI Analysis
Risk summary
An oversized transmit buffer submitted to the NTB transport layer is silently accepted and then completed with a NULL data pointer, causing the associated network packet (skb) to be leaked. A local attacker with access to the NTB network interface can repeatedly trigger this path to exhaust kernel memory and cause a denial of service. The fix rejects oversized buffers early with an explicit error so the caller frees the packet.
Vulnerability analysis
When a transmit buffer larger than the configured NTB frame size is submitted, the transport layer invokes the completion callback with a NULL data pointer and reports success, so the network device driver never frees the packet buffer and never takes its error path either. Each oversized packet is therefore leaked, and because the path returns success the caller has no reason to stop sending. The fix moves the size check to the enqueue entry point and returns a permanent error code, leaving buffer ownership with the caller so it can free the packet normally. The vulnerable path is reachable from a local process that can send traffic over the NTB virtual network interface, which requires the NTB hardware and driver to be present and the link to be up; no special capabilities beyond network access to that interface are needed.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.9 | 5.10.270 | 4890152a3069 |
| 5.15 | 3.9 | 5.15.221 | 668aa3238548 |
| 6.1 | 3.9 | 6.1.188 | 9b0fa8a9e105 |
| 6.12 | 3.9 | 6.12.109 | a7f22105a7df |
| 6.18 | 3.9 | 6.18.50 | 6b6bbc6c878d |
| 6.6 | 3.9 | 6.6.157 | b6db88cde0fb |
| 7.2 | 3.9 | 7.2.4 | 75a604e9f1cf |
| mainline | 3.9 | 7.3 | a4f2387db6f1 |
| cip/5.10 | 3.9 | 5.10.271-cip78 | 4890152a3069 |
| cip/6.1 | 3.9 | 6.1.189-cip61 | 9b0fa8a9e105 |
| cip/6.1-rt | 3.9 | 6.1.189-cip61-rt32 | 9b0fa8a9e105 |
| cip/6.12 | 3.9 | 6.12.111-cip32 | a7f22105a7df |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |