CVE-2026-80987 (GCVE-0-2026-80987)
Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-10-19 08:46
VLAI
EPSS
VEX
Title
NTB: ntb_transport: Reject oversized TX buffers
Summary
In the Linux kernel, the following vulnerability has been resolved:
NTB: ntb_transport: Reject oversized TX buffers
ntb_process_tx() handles an oversized buffer by calling tx_handler()
with a NULL data pointer and returning success. ntb_netdev therefore
neither frees the skb in its completion callback nor takes its enqueue
error path, leaking it.
Reject oversized buffers in ntb_transport_tx_enqueue() before acquiring
a queue entry and return -EMSGSIZE. The caller retains ownership of the
buffer, and the preceding netdev patch frees the skb when enqueue
returns this permanent error.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:21 UTC
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < 4890152a3069f5cb58cc24b08cfd5fe95e568fa1
(git)
Affected: fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < 668aa3238548584ca9772da9cf43ae8c2389bbf1 (git) Affected: fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < 9b0fa8a9e1057614a533cc3f18b17f82aab028d8 (git) Affected: fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < b6db88cde0fb5c3bd2d3cd2bebcc06b5ce146e88 (git) Affected: fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < a7f22105a7df8c7fd74d0af27ace6fa94fe03d87 (git) Affected: fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < 6b6bbc6c878d64eacc60877df49fce7b1b6a08d0 (git) Affected: fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < 75a604e9f1cfdebda421062fdf42225ca32154cd (git) Affected: fce8a7bb5b4bfb8a27324703fd5b002ee9247e90 , < a4f2387db6f1cc2f03abba7f3a6807ad61e26ff7 (git) |
guessed | |
| Linux | Linux |
Affected:
3.9
Unaffected: 0 , < 3.9 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.109 , ≤ 6.12.* (semver) Unaffected: 6.18.50 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80987",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:21:52.922531Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:37.690Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ntb/ntb_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4890152a3069f5cb58cc24b08cfd5fe95e568fa1",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "668aa3238548584ca9772da9cf43ae8c2389bbf1",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "9b0fa8a9e1057614a533cc3f18b17f82aab028d8",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "b6db88cde0fb5c3bd2d3cd2bebcc06b5ce146e88",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "a7f22105a7df8c7fd74d0af27ace6fa94fe03d87",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "6b6bbc6c878d64eacc60877df49fce7b1b6a08d0",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "75a604e9f1cfdebda421062fdf42225ca32154cd",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "a4f2387db6f1cc2f03abba7f3a6807ad61e26ff7",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ntb/ntb_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNTB: ntb_transport: Reject oversized TX buffers\n\nntb_process_tx() handles an oversized buffer by calling tx_handler()\nwith a NULL data pointer and returning success. ntb_netdev therefore\nneither frees the skb in its completion callback nor takes its enqueue\nerror path, leaking it.\n\nReject oversized buffers in ntb_transport_tx_enqueue() before acquiring\na queue entry and return -EMSGSIZE. The caller retains ownership of the\nbuffer, and the preceding netdev patch frees the skb when enqueue\nreturns this permanent error."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - ntb_transport_tx_enqueue() is reached from ntb_netdev_start_xmit() on the NTB virtual Ethernet device; in dual-controller/cluster deployments that interconnect carries routed or 802.1Q traffic, so a remote peer can induce full-MTU egress (software VLAN insertion adds VLAN_HLEN past the transport payload limit) without local access.\nAC:L - Any TX buffer longer than tx_max_frame minus the payload header deterministically takes the oversized path; VLAN devices default to the lowerdev MTU so tagged full-size frames always exceed the limit, and AF_PACKET allows MTU+VLAN_HLEN, with no race or uncontrolled layout.\nPR:N - The netdev TX path has no authentication or capability check; once the NTB link is up, any host exchanging traffic over the interconnect or a VLAN/service on it can cause oversized transmits without credentials on the victim.\nUI:N - Oversized frames are transmitted by the kernel networking stack during ordinary packet egress; no victim action such as mounting a device or opening a file is required.\nS:U - The defect leaks sk_buff memory on the transmitting host inside the same kernel authority; it is not a VM escape, IOMMU/DMA bypass, or corruption of the peer host over the NTB link.\nC:N - The oversized path never copies payload bytes and does not free or reuse the skb, so there is no out-of-bounds read, use-after-free, or other information-disclosure primitive.\nI:N - ntb_process_tx() refuses to DMA or memcpy an oversized buffer and only invokes the completion callback with a NULL pointer, so there is no out-of-bounds write, heap corruption, or control-flow hijacking.\nA:H - Enqueue returns success while the TX handler is called with a NULL skb and skips kfree, permanently leaking one sk_buff (and its pages/socket accounting) per oversized transmit; repeating this exhausts kernel memory and causes OOM denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:46:11.577Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4890152a3069f5cb58cc24b08cfd5fe95e568fa1"
},
{
"url": "https://git.kernel.org/stable/c/668aa3238548584ca9772da9cf43ae8c2389bbf1"
},
{
"url": "https://git.kernel.org/stable/c/9b0fa8a9e1057614a533cc3f18b17f82aab028d8"
},
{
"url": "https://git.kernel.org/stable/c/b6db88cde0fb5c3bd2d3cd2bebcc06b5ce146e88"
},
{
"url": "https://git.kernel.org/stable/c/a7f22105a7df8c7fd74d0af27ace6fa94fe03d87"
},
{
"url": "https://git.kernel.org/stable/c/6b6bbc6c878d64eacc60877df49fce7b1b6a08d0"
},
{
"url": "https://git.kernel.org/stable/c/75a604e9f1cfdebda421062fdf42225ca32154cd"
},
{
"url": "https://git.kernel.org/stable/c/a4f2387db6f1cc2f03abba7f3a6807ad61e26ff7"
}
],
"title": "NTB: ntb_transport: Reject oversized TX buffers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80987",
"datePublished": "2026-09-11T19:42:45.574Z",
"dateReserved": "2026-08-26T14:34:25.811Z",
"dateUpdated": "2026-10-19T08:46:11.577Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-80987",
"date": "2026-11-08",
"epss": "0.00501",
"percentile": "0.43193"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ntb/ntb_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4890152a3069f5cb58cc24b08cfd5fe95e568fa1",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "668aa3238548584ca9772da9cf43ae8c2389bbf1",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "9b0fa8a9e1057614a533cc3f18b17f82aab028d8",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "b6db88cde0fb5c3bd2d3cd2bebcc06b5ce146e88",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "a7f22105a7df8c7fd74d0af27ace6fa94fe03d87",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "6b6bbc6c878d64eacc60877df49fce7b1b6a08d0",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "75a604e9f1cfdebda421062fdf42225ca32154cd",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "a4f2387db6f1cc2f03abba7f3a6807ad61e26ff7",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ntb/ntb_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNTB: ntb_transport: Reject oversized TX buffers\n\nntb_process_tx() handles an oversized buffer by calling tx_handler()\nwith a NULL data pointer and returning success. ntb_netdev therefore\nneither frees the skb in its completion callback nor takes its enqueue\nerror path, leaking it.\n\nReject oversized buffers in ntb_transport_tx_enqueue() before acquiring\na queue entry and return -EMSGSIZE. The caller retains ownership of the\nbuffer, and the preceding netdev patch frees the skb when enqueue\nreturns this permanent error."
}
],
"id": "CVE-2026-80987",
"lastModified": "2026-10-19T09:17:31.350",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-80987",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:21:52.922531Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-11T20:19:05.353",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/4890152a3069f5cb58cc24b08cfd5fe95e568fa1"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/668aa3238548584ca9772da9cf43ae8c2389bbf1"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/6b6bbc6c878d64eacc60877df49fce7b1b6a08d0"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/75a604e9f1cfdebda421062fdf42225ca32154cd"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/9b0fa8a9e1057614a533cc3f18b17f82aab028d8"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a4f2387db6f1cc2f03abba7f3a6807ad61e26ff7"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a7f22105a7df8c7fd74d0af27ace6fa94fe03d87"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/b6db88cde0fb5c3bd2d3cd2bebcc06b5ce146e88"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Low",
"current_release_date": "2026-11-07T04:53:49+00:00",
"cve": "CVE-2026-80987",
"id": "CVE-2026-80987",
"initial_release_date": "2026-09-11T00:00:00+00:00",
"product_status:known_affected": "189",
"product_status:known_not_affected": "14",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: NTB: ntb_transport: Reject oversized TX buffers",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80987.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80987",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:21:52.922531Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:21:53.858Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ntb/ntb_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4890152a3069f5cb58cc24b08cfd5fe95e568fa1",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "668aa3238548584ca9772da9cf43ae8c2389bbf1",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "9b0fa8a9e1057614a533cc3f18b17f82aab028d8",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "b6db88cde0fb5c3bd2d3cd2bebcc06b5ce146e88",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "a7f22105a7df8c7fd74d0af27ace6fa94fe03d87",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "6b6bbc6c878d64eacc60877df49fce7b1b6a08d0",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "75a604e9f1cfdebda421062fdf42225ca32154cd",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
},
{
"lessThan": "a4f2387db6f1cc2f03abba7f3a6807ad61e26ff7",
"status": "affected",
"version": "fce8a7bb5b4bfb8a27324703fd5b002ee9247e90",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ntb/ntb_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNTB: ntb_transport: Reject oversized TX buffers\n\nntb_process_tx() handles an oversized buffer by calling tx_handler()\nwith a NULL data pointer and returning success. ntb_netdev therefore\nneither frees the skb in its completion callback nor takes its enqueue\nerror path, leaking it.\n\nReject oversized buffers in ntb_transport_tx_enqueue() before acquiring\na queue entry and return -EMSGSIZE. The caller retains ownership of the\nbuffer, and the preceding netdev patch frees the skb when enqueue\nreturns this permanent error."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - ntb_transport_tx_enqueue() is reached from ntb_netdev_start_xmit() on the NTB virtual Ethernet device; in dual-controller/cluster deployments that interconnect carries routed or 802.1Q traffic, so a remote peer can induce full-MTU egress (software VLAN insertion adds VLAN_HLEN past the transport payload limit) without local access.\nAC:L - Any TX buffer longer than tx_max_frame minus the payload header deterministically takes the oversized path; VLAN devices default to the lowerdev MTU so tagged full-size frames always exceed the limit, and AF_PACKET allows MTU+VLAN_HLEN, with no race or uncontrolled layout.\nPR:N - The netdev TX path has no authentication or capability check; once the NTB link is up, any host exchanging traffic over the interconnect or a VLAN/service on it can cause oversized transmits without credentials on the victim.\nUI:N - Oversized frames are transmitted by the kernel networking stack during ordinary packet egress; no victim action such as mounting a device or opening a file is required.\nS:U - The defect leaks sk_buff memory on the transmitting host inside the same kernel authority; it is not a VM escape, IOMMU/DMA bypass, or corruption of the peer host over the NTB link.\nC:N - The oversized path never copies payload bytes and does not free or reuse the skb, so there is no out-of-bounds read, use-after-free, or other information-disclosure primitive.\nI:N - ntb_process_tx() refuses to DMA or memcpy an oversized buffer and only invokes the completion callback with a NULL pointer, so there is no out-of-bounds write, heap corruption, or control-flow hijacking.\nA:H - Enqueue returns success while the TX handler is called with a NULL skb and skips kfree, permanently leaking one sk_buff (and its pages/socket accounting) per oversized transmit; repeating this exhausts kernel memory and causes OOM denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:46:11.577Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4890152a3069f5cb58cc24b08cfd5fe95e568fa1"
},
{
"url": "https://git.kernel.org/stable/c/668aa3238548584ca9772da9cf43ae8c2389bbf1"
},
{
"url": "https://git.kernel.org/stable/c/9b0fa8a9e1057614a533cc3f18b17f82aab028d8"
},
{
"url": "https://git.kernel.org/stable/c/b6db88cde0fb5c3bd2d3cd2bebcc06b5ce146e88"
},
{
"url": "https://git.kernel.org/stable/c/a7f22105a7df8c7fd74d0af27ace6fa94fe03d87"
},
{
"url": "https://git.kernel.org/stable/c/6b6bbc6c878d64eacc60877df49fce7b1b6a08d0"
},
{
"url": "https://git.kernel.org/stable/c/75a604e9f1cfdebda421062fdf42225ca32154cd"
},
{
"url": "https://git.kernel.org/stable/c/a4f2387db6f1cc2f03abba7f3a6807ad61e26ff7"
}
],
"title": "NTB: ntb_transport: Reject oversized TX buffers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80987",
"datePublished": "2026-09-11T19:42:45.574Z",
"dateReserved": "2026-08-26T14:34:25.811Z",
"dateUpdated": "2026-10-19T08:46:11.577Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.