CVE-2026-80987 NTB: ntb_transport: Reject oversized TX buffers
An attacker can cause a memory leak in the Linux kernel NTB transport driver by sending oversized TX buffers, leading to resource exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80987?
CVE-2026-80987 is a high-severity denial of service vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
NTB: ntb_transport: Reject oversized TX buffers
ntb_process_tx() handles an oversized buffer by calling tx_handler() with a NULL data pointer and returning success. ntb_netdev therefore neither frees the skb in its completion callback nor takes its enqueue error path, leaking it.
Reject oversized buffers in ntb_transport_tx_enqueue() before acquiring a queue entry and return -EMSGSIZE. The caller retains ownership of the buffer, and the preceding netdev patch frees the skb when enqueue returns this permanent error.
Which versions are affected by CVE-2026-80987?
How do I fix CVE-2026-80987?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-80987 being exploited?
There is no known exploitation of CVE-2026-80987 in the wild and no public exploit code.
Sources
Also known as AZL-100880, BELL-CVE-2026-80987, DEBIAN-CVE-2026-80987, GHSA-485c-xrj6-wvh4, UBUNTU-CVE-2026-80987.