Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-80988

NTB: ntb_transport: Fail TX enqueue when the QP link is down

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.270, 5.15.221, 6.1.188, 4.15, 4.20, and 7 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: NTB: ntb_transport: Fail TX enqueue when the QP link is down Commit f195a1a6fe41 ("ntb: Drop packets when qp link is down") meant to make ntb_transport_tx_enqueue() drop packets submitted while the QP link is down, but it only returns 0 without consuming the packet. Zero means success by this function's contract, so ntb_netdev reports NETDEV_TX_OK and forgets the skb: nothing queued it, nothing frees it, and it leaks, one skb for every transmit racing a link-down. Return -ENOLINK instead, restoring the contract that a non-zero return leaves the buffer owned by the caller. With the preceding patch, ntb_netdev frees the skb on non-retryable enqueue failures and returns NETDEV_TX_OK, so a packet racing with link-down is dropped without leaking or entering a busy retry loop.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 3cfdc448e8bfa8a7eaa5af87f357330566124b78 · fixed in 76c9ccc0c6bebfc74c0e727eda67687f5103ab06; From bfa051f650a7708183bd86901ca4645dcf88c486 · fixed in 96d792c65b9d5f7f9dd86a1004315db59e450c07; From 4f4af6b8b7a23fa37decaf43b55403e6bfd8e219 · fixed in 45cc11035165918dd1f81796ea98f81ece20d361; From f195a1a6fe416882984f8bd6c61afc1383171860 · fixed in e6cc541fab01099fd8efadfa4f13afdf118bf536; From f195a1a6fe416882984f8bd6c61afc1383171860 · fixed in 5eca0d899a3be661a7e2caaaa7467a6fa15d756c; From f195a1a6fe416882984f8bd6c61afc1383171860 · fixed in 894e136b432da75c0352c80299807a5c4b04f167; From f195a1a6fe416882984f8bd6c61afc1383171860 · fixed in 89177732fe1653bbfef10cf5d99bf20cf57762c2; From f195a1a6fe416882984f8bd6c61afc1383171860 · fixed in 873ce713fef5dde0939220f04f3484ec86a16fba; From 5.10.195 · fixed in 5.10.270; From 5.15.132 · fixed in 5.15.221; From 6.1.53 · fixed in 6.1.188; From 4.14.326 · fixed in 4.15; From 4.19.295 · fixed in 4.20; From 5.4.257 · fixed in 5.5; From 6.4.16 · fixed in 6.5; From 6.5.3 · fixed in 6.6

  • Linux Linux

    6.6

  • KernelLinux

    fixed in 5.10.270; From 5.11.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.6.0 · fixed in 6.12.109; From 6.7.0 · fixed in 6.18.50; From 6.13.0 · fixed in 7.2.4

References 8

git.kernel.org