GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80987 (GCVE-0-2026-80987)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-14 11:59
VLAI
Title
NTB: ntb_transport: Reject oversized TX buffers
Summary
In the Linux kernel, the following vulnerability has been resolved: NTB: ntb_transport: Reject oversized TX buffers ntb_process_tx() handles an oversized buffer by calling tx_handler() with a NULL data pointer and returning success. ntb_netdev therefore neither frees the skb in its completion callback nor takes its enqueue error path, leaking it. Reject oversized buffers in ntb_transport_tx_enqueue() before acquiring a queue entry and return -EMSGSIZE. The caller retains ownership of the buffer, and the preceding netdev patch frees the skb when enqueue returns this permanent error.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < 4890152a3069f5cb58cc24b08cfd5fe95e568fa1 (git)
Affected: fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < 668aa3238548584ca9772da9cf43ae8c2389bbf1 (git)
Affected: fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < 9b0fa8a9e1057614a533cc3f18b17f82aab028d8 (git)
Affected: fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < b6db88cde0fb5c3bd2d3cd2bebcc06b5ce146e88 (git)
Affected: fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < a7f22105a7df8c7fd74d0af27ace6fa94fe03d87 (git)
Affected: fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < 6b6bbc6c878d64eacc60877df49fce7b1b6a08d0 (git)
Affected: fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < 75a604e9f1cfdebda421062fdf42225ca32154cd (git)
Affected: fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < a4f2387db6f1cc2f03abba7f3a6807ad61e26ff7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.9
Unaffected: 0 , < 3.9 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ntb/ntb_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4890152a3069f5cb58cc24b08cfd5fe95e568fa1",
              "status": "affected",
              "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
              "versionType": "git"
            },
            {
              "lessThan": "668aa3238548584ca9772da9cf43ae8c2389bbf1",
              "status": "affected",
              "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
              "versionType": "git"
            },
            {
              "lessThan": "9b0fa8a9e1057614a533cc3f18b17f82aab028d8",
              "status": "affected",
              "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
              "versionType": "git"
            },
            {
              "lessThan": "b6db88cde0fb5c3bd2d3cd2bebcc06b5ce146e88",
              "status": "affected",
              "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
              "versionType": "git"
            },
            {
              "lessThan": "a7f22105a7df8c7fd74d0af27ace6fa94fe03d87",
              "status": "affected",
              "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
              "versionType": "git"
            },
            {
              "lessThan": "6b6bbc6c878d64eacc60877df49fce7b1b6a08d0",
              "status": "affected",
              "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
              "versionType": "git"
            },
            {
              "lessThan": "75a604e9f1cfdebda421062fdf42225ca32154cd",
              "status": "affected",
              "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
              "versionType": "git"
            },
            {
              "lessThan": "a4f2387db6f1cc2f03abba7f3a6807ad61e26ff7",
              "status": "affected",
              "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ntb/ntb_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNTB: ntb_transport: Reject oversized TX buffers\n\nntb_process_tx() handles an oversized buffer by calling tx_handler()\nwith a NULL data pointer and returning success. ntb_netdev therefore\nneither frees the skb in its completion callback nor takes its enqueue\nerror path, leaking it.\n\nReject oversized buffers in ntb_transport_tx_enqueue() before acquiring\na queue entry and return -EMSGSIZE. The caller retains ownership of the\nbuffer, and the preceding netdev patch frees the skb when enqueue\nreturns this permanent error."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ntb_transport_tx_enqueue() is reached from ntb_netdev_start_xmit() on the NTB virtual Ethernet device; in dual-controller/cluster deployments that interconnect carries routed or 802.1Q traffic, so a remote peer can induce full-MTU egress (software VLAN insertion adds VLAN_HLEN past the transport payload limit) without local access.\nAC:L - Any TX buffer longer than tx_max_frame minus the payload header deterministically takes the oversized path; VLAN devices default to the lowerdev MTU so tagged full-size frames always exceed the limit, and AF_PACKET allows MTU+VLAN_HLEN, with no race or uncontrolled layout.\nPR:N - The netdev TX path has no authentication or capability check; once the NTB link is up, any host exchanging traffic over the interconnect or a VLAN/service on it can cause oversized transmits without credentials on the victim.\nUI:N - Oversized frames are transmitted by the kernel networking stack during ordinary packet egress; no victim action such as mounting a device or opening a file is required.\nS:U - The defect leaks sk_buff memory on the transmitting host inside the same kernel authority; it is not a VM escape, IOMMU/DMA bypass, or corruption of the peer host over the NTB link.\nC:N - The oversized path never copies payload bytes and does not free or reuse the skb, so there is no out-of-bounds read, use-after-free, or other information-disclosure primitive.\nI:N - ntb_process_tx() refuses to DMA or memcpy an oversized buffer and only invokes the completion callback with a NULL pointer, so there is no out-of-bounds write, heap corruption, or control-flow hijacking.\nA:H - Enqueue returns success while the TX handler is called with a NULL skb and skips kfree, permanently leaking one sk_buff (and its pages/socket accounting) per oversized transmit; repeating this exhausts kernel memory and causes OOM denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:59:28.875Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4890152a3069f5cb58cc24b08cfd5fe95e568fa1"
        },
        {
          "url": "https://git.kernel.org/stable/c/668aa3238548584ca9772da9cf43ae8c2389bbf1"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b0fa8a9e1057614a533cc3f18b17f82aab028d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6db88cde0fb5c3bd2d3cd2bebcc06b5ce146e88"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7f22105a7df8c7fd74d0af27ace6fa94fe03d87"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b6bbc6c878d64eacc60877df49fce7b1b6a08d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/75a604e9f1cfdebda421062fdf42225ca32154cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4f2387db6f1cc2f03abba7f3a6807ad61e26ff7"
        }
      ],
      "title": "NTB: ntb_transport: Reject oversized TX buffers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80987",
    "datePublished": "2026-09-11T19:42:45.574Z",
    "dateReserved": "2026-08-26T14:34:25.811Z",
    "dateUpdated": "2026-09-14T11:59:28.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80987",
      "date": "2026-09-17",
      "epss": "0.00508",
      "percentile": "0.42185"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/ntb/ntb_transport.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4890152a3069f5cb58cc24b08cfd5fe95e568fa1",
                    "status": "affected",
                    "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "668aa3238548584ca9772da9cf43ae8c2389bbf1",
                    "status": "affected",
                    "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9b0fa8a9e1057614a533cc3f18b17f82aab028d8",
                    "status": "affected",
                    "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b6db88cde0fb5c3bd2d3cd2bebcc06b5ce146e88",
                    "status": "affected",
                    "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a7f22105a7df8c7fd74d0af27ace6fa94fe03d87",
                    "status": "affected",
                    "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6b6bbc6c878d64eacc60877df49fce7b1b6a08d0",
                    "status": "affected",
                    "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "75a604e9f1cfdebda421062fdf42225ca32154cd",
                    "status": "affected",
                    "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a4f2387db6f1cc2f03abba7f3a6807ad61e26ff7",
                    "status": "affected",
                    "version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/ntb/ntb_transport.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.9"
                  },
                  {
                    "lessThan": "3.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNTB: ntb_transport: Reject oversized TX buffers\n\nntb_process_tx() handles an oversized buffer by calling tx_handler()\nwith a NULL data pointer and returning success. ntb_netdev therefore\nneither frees the skb in its completion callback nor takes its enqueue\nerror path, leaking it.\n\nReject oversized buffers in ntb_transport_tx_enqueue() before acquiring\na queue entry and return -EMSGSIZE. The caller retains ownership of the\nbuffer, and the preceding netdev patch frees the skb when enqueue\nreturns this permanent error."
          }
        ],
        "id": "CVE-2026-80987",
        "lastModified": "2026-09-14T13:18:53.343",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:05.353",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4890152a3069f5cb58cc24b08cfd5fe95e568fa1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/668aa3238548584ca9772da9cf43ae8c2389bbf1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6b6bbc6c878d64eacc60877df49fce7b1b6a08d0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/75a604e9f1cfdebda421062fdf42225ca32154cd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9b0fa8a9e1057614a533cc3f18b17f82aab028d8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a4f2387db6f1cc2f03abba7f3a6807ad61e26ff7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a7f22105a7df8c7fd74d0af27ace6fa94fe03d87"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b6db88cde0fb5c3bd2d3cd2bebcc06b5ce146e88"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-14T19:49:51+00:00",
      "cve": "CVE-2026-80987",
      "id": "CVE-2026-80987",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "262",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: NTB: ntb_transport: Reject oversized TX buffers",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80987.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:04:39Z",
      "cve": "CVE-2026-80987",
      "id": "CVE-2026-80987",
      "initial_release_date": "2026-09-12T16:36:12Z",
      "product_status:known_affected": "349",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80987",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80987.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.