CVE-2026-80988

NTB: ntb_transport: Fail TX enqueue when the QP link is down

Published Sep 11, 2026 CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

NTB: ntb_transport: Fail TX enqueue when the QP link is down

Commit f195a1a6fe41 ("ntb: Drop packets when qp link is down") meant to
make ntb_transport_tx_enqueue() drop packets submitted while the QP link
is down, but it only returns 0 without consuming the packet. Zero means
success by this function's contract, so ntb_netdev reports NETDEV_TX_OK
and forgets the skb: nothing queued it, nothing frees it, and it leaks,
one skb for every transmit racing a link-down.

Return -ENOLINK instead, restoring the contract that a non-zero return
leaves the buffer owned by the caller. With the preceding patch,
ntb_netdev frees the skb on non-retryable enqueue failures and returns
NETDEV_TX_OK, so a packet racing with link-down is dropped without leaking
or entering a busy retry loop.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3cfdc448e8bfa8a7eaa5af87f357330566124b78`	affected	< 76c9ccc0c6bebfc74c0e727eda67687f5103ab06
`bfa051f650a7708183bd86901ca4645dcf88c486`	affected	< 96d792c65b9d5f7f9dd86a1004315db59e450c07
`4f4af6b8b7a23fa37decaf43b55403e6bfd8e219`	affected	< 45cc11035165918dd1f81796ea98f81ece20d361
`f195a1a6fe416882984f8bd6c61afc1383171860`	affected	< e6cc541fab01099fd8efadfa4f13afdf118bf536
`f195a1a6fe416882984f8bd6c61afc1383171860`	affected	< 5eca0d899a3be661a7e2caaaa7467a6fa15d756c
`f195a1a6fe416882984f8bd6c61afc1383171860`	affected	< 894e136b432da75c0352c80299807a5c4b04f167
`f195a1a6fe416882984f8bd6c61afc1383171860`	affected	< 89177732fe1653bbfef10cf5d99bf20cf57762c2
`f195a1a6fe416882984f8bd6c61afc1383171860`	affected	< 873ce713fef5dde0939220f04f3484ec86a16fba
`aa6d6ed213b62cbdb09ea32abbfa085dd987a0c9`	affected	—
`a8986a61ebee0b54c5d648444fbae09bd1c6dcd2`	affected	—
`94491412a2afc8a5aea4c5b455aed86d3486f0b1`	affected	—
`c2cd5d993f57f819d46fe62387d3cc34d8468e60`	affected	—
`449b1978d4e50b14b2a4de3a26d0b074593926a3`	affected	—
`5.10.195`	affected	< 5.10.270
`5.15.132`	affected	< 5.15.221
`6.1.53`	affected	< 6.1.188
`4.14.326`	affected	< 4.15
`4.19.295`	affected	< 4.20
`5.4.257`	affected	< 5.5
`6.4.16`	affected	< 6.5
`6.5.3`	affected	< 6.6

Linux

affected

Version	Status	Constraints
`6.6`	affected	—
`0`	unaffected	< 6.6
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[f195a1a6fe416882984f8bd6c61afc1383171860,5eca0d899a3be661a7e2caaaa7467a6fa15d756c)`	affected	code_commit	—
`[f195a1a6fe416882984f8bd6c61afc1383171860,894e136b432da75c0352c80299807a5c4b04f167)`	affected	code_commit	—
`[f195a1a6fe416882984f8bd6c61afc1383171860,89177732fe1653bbfef10cf5d99bf20cf57762c2)`	affected	code_commit	—
`[f195a1a6fe416882984f8bd6c61afc1383171860,873ce713fef5dde0939220f04f3484ec86a16fba)`	affected	code_commit	—
`aa6d6ed213b62cbdb09ea32abbfa085dd987a0c9`	affected	code_commit	—
`a8986a61ebee0b54c5d648444fbae09bd1c6dcd2`	affected	code_commit	—
`94491412a2afc8a5aea4c5b455aed86d3486f0b1`	affected	code_commit	—
`3cfdc448e8bfa8a7eaa5af87f357330566124b78`	affected	code_commit	—
`bfa051f650a7708183bd86901ca4645dcf88c486`	affected	code_commit	—
`4f4af6b8b7a23fa37decaf43b55403e6bfd8e219`	affected	code_commit	—
`c2cd5d993f57f819d46fe62387d3cc34d8468e60`	affected	code_commit	—
`449b1978d4e50b14b2a4de3a26d0b074593926a3`	affected	code_commit	—
`[4.14.326,4.15.0)`	affected	semver	—
`[4.19.295,4.20.0)`	affected	semver	—
`[5.4.257,5.5.0)`	affected	semver	—
`[5.10.195,5.11.0)`	affected	semver	—
`[5.15.132,5.16.0)`	affected	semver	—
`[6.1.53,6.2.0)`	affected	semver	—
`[6.4.16,6.5.0)`	affected	semver	—
`[6.5.3,6.6.0)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.6`	affected	generic	—
`[0,6.6)`	unaffected	generic	—
`[6.12.109,6.13.0]`	unaffected	semver	—
`[6.18.50,6.19.0]`	unaffected	semver	—
`[7.2.4,7.3.0]`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.177% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/45cc11035165918dd1f81796ea98f81ece20d361
https://git.kernel.org/stable/c/5eca0d899a3be661a7e2caaaa7467a6fa15d756c
https://git.kernel.org/stable/c/76c9ccc0c6bebfc74c0e727eda67687f5103ab06
https://git.kernel.org/stable/c/873ce713fef5dde0939220f04f3484ec86a16fba
https://git.kernel.org/stable/c/89177732fe1653bbfef10cf5d99bf20cf57762c2
https://git.kernel.org/stable/c/894e136b432da75c0352c80299807a5c4b04f167
https://git.kernel.org/stable/c/96d792c65b9d5f7f9dd86a1004315db59e450c07
https://git.kernel.org/stable/c/e6cc541fab01099fd8efadfa4f13afdf118bf536
https://nvd.nist.gov/vuln/detail/CVE-2026-80988
https://www.cve.org/CVERecord?id=CVE-2026-80988

History

Sep 14, 2026 12:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/45cc11035165918dd1f81796ea98f81ece20d361 https://git.kernel.org/stable/c/76c9ccc0c6bebfc74c0e727eda67687f5103ab06 https://git.kernel.org/stable/c/96d792c65b9d5f7f9dd86a1004315db59e450c07 https://git.kernel.org/stable/c/e6cc541fab01099fd8efadfa4f13afdf118bf536

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80988 https://www.cve.org/CVERecord?id=CVE-2026-80988
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: NTB: ntb_transport: Fail TX enqueue when the QP link is down Commit f195a1a6fe41 ("ntb: Drop packets when qp link is down") meant to make ntb_transport_tx_enqueue() drop packets submitted while the QP link is down, but it only returns 0 without consuming the packet. Zero means success by this function's contract, so ntb_netdev reports NETDEV_TX_OK and forgets the skb: nothing queued it, nothing frees it, and it leaks, one skb for every transmit racing a link-down. Return -ENOLINK instead, restoring the contract that a non-zero return leaves the buffer owned by the caller. With the preceding patch, ntb_netdev frees the skb on non-retryable enqueue failures and returns NETDEV_TX_OK, so a packet racing with link-down is dropped without leaking or entering a busy retry loop.
Title		NTB: ntb_transport: Fail TX enqueue when the QP link is down
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5eca0d899a3be661a7e2caaaa7467a6fa15d756c https://git.kernel.org/stable/c/873ce713fef5dde0939220f04f3484ec86a16fba https://git.kernel.org/stable/c/89177732fe1653bbfef10cf5d99bf20cf57762c2 https://git.kernel.org/stable/c/894e136b432da75c0352c80299807a5c4b04f167