CVE-2026-80988

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NTB: ntb_transport: Fail TX enqueue when the QP link is down

Commit f195a1a6fe41 ("ntb: Drop packets when qp link is down") meant to

make ntb_transport_tx_enqueue() drop packets submitted while the QP link

is down, but it only returns 0 without consuming the packet. Zero means

success by this function's contract, so ntb_netdev reports NETDEV_TX_OK

and forgets the skb: nothing queued it, nothing frees it, and it leaks,

one skb for every transmit racing a link-down.

Return -ENOLINK instead, restoring the contract that a non-zero return

leaves the buffer owned by the caller. With the preceding patch,

ntb_netdev frees the skb on non-retryable enqueue failures and returns

NETDEV_TX_OK, so a packet racing with link-down is dropped without leaking

or entering a busy retry loop.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References