EUVD-2026-64563
GHSA-2vc2-fj43-9qhc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AC:H because triggering skb allocation failure requires memory pressure beyond attacker's direct control; no confidentiality or integrity impact applies.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
NTB: ntb_netdev: Preserve RX queue depth on allocation failure
ntb_netdev_rx_handler() hands the received skb to the network stack before allocating its replacement. If the allocation fails, nothing is reposted. Every failure therefore takes one buffer out of the RX queue while the interface remains up, and enough failures eventually stall reception.
A retry path could refill the queue later, but ntb_netdev has none. Allocate the replacement first instead. If that fails, drop the packet and repost the same skb. This keeps the queue full and lets packet delivery resume as soon as memory is available again.
AnalysisAI
Reception stall denial-of-service in the Linux kernel's ntb_netdev driver allows remote unauthenticated attackers to progressively exhaust the NTB network interface's RX queue by triggering repeated memory allocation failures during packet reception, ultimately halting all inbound packet delivery while the interface remains administratively up. Systems with NTB-capable PCIe hardware (Non-Transparent Bridge interconnects) running affected kernel versions are at risk; standard Linux deployments without this hardware are entirely unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target system to have NTB-capable PCIe hardware (such as an Intel Xeon NTB controller or Microsemi Switchtec device) with the ntb_netdev kernel module loaded and the resulting NTB network interface in the 'up' (IFF_UP) state. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 and represents the worst-case interpretation where an attacker's own packet flood can precipitate memory pressure sufficient to trigger allocation failures. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to the NTB-connected peer interface sends a sustained flood of packets to the target host while it is under memory pressure - either independently occurring or exacerbated by the flood itself consuming socket buffer memory. Each packet received during a failed skb allocation permanently removes one slot from the RX queue; after enough such events the queue drains to zero and the NTB interface silently ceases delivering packets, denying connectivity for any workload depending on the NTB link. … |
| Remediation | The primary fix is applying one of the upstream stable kernel commits: 755fd7843f300d724caceabdf9bb13adc8701540 (https://git.kernel.org/stable/c/755fd7843f300d724caceabdf9bb13adc8701540), d2121faf133ac3bf9531b53a7e21273649a08517 (https://git.kernel.org/stable/c/d2121faf133ac3bf9531b53a7e21273649a08517), or a4e340971fe8ccd245d206db4d43b2a0eec240bd (https://git.kernel.org/stable/c/a4e340971fe8ccd245d206db4d43b2a0eec240bd) depending on the stable branch in use; EUVD identifies patched upstream releases at versions 7.1.9 and 7.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory your infrastructure to confirm whether you operate NTB-capable PCIe hardware and identify which systems run affected kernel versions; most standard Linux deployments are unaffected and require no action. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today