EUVD-2026-76310
GHSA-485c-xrj6-wvh4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NTB is a PCIe physical interconnect; the attacking peer is adjacent by hardware, making AV:A more accurate than AV:N for direct NTB exploitation.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
NTB: ntb_transport: Reject oversized TX buffers
ntb_process_tx() handles an oversized buffer by calling tx_handler() with a NULL data pointer and returning success. ntb_netdev therefore neither frees the skb in its completion callback nor takes its enqueue error path, leaking it.
Reject oversized buffers in ntb_transport_tx_enqueue() before acquiring a queue entry and return -EMSGSIZE. The caller retains ownership of the buffer, and the preceding netdev patch frees the skb when enqueue returns this permanent error.
AnalysisAI
Memory leak (skb leak) in the Linux kernel's NTB (Non-Transparent Bridge) transport subsystem allows an attacker reachable via the ntb_netdev virtual network interface to cause progressive kernel memory exhaustion and denial of service. The bug exists in ntb_process_tx(), which silently "handles" oversized TX buffers by invoking tx_handler() with a NULL data pointer and returning success - causing ntb_netdev to skip both its completion-callback free and its enqueue error path, permanently leaking the socket buffer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Linux system to have PCIe NTB hardware physically installed and the ntb_transport and ntb_netdev kernel modules loaded and active - these are non-default, hardware-dependent conditions absent on the vast majority of Linux deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) assumes full network reachability without authentication, which holds if ntb_netdev participates in Linux bridging or routing - oversized packets from any network could be forwarded through the interface and trigger the TX path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched kernel version: 6.12.109 or later for the 6.12.x stable series, 6.18.50 or later for the 6.18.x series, 7.2.4 or later for the 7.2.x series, or 7.3-rc1 or later for mainline. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, determine which systems in your infrastructure depend on NTB transport configuration and assess patch eligibility for those systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today