Linux kernel ntb_transport: oversized transmit buffers leak skbs until the host runs out of memory

Impact

ntb_process_tx() treats an oversized buffer as a success and calls tx_handler() with a NULL data pointer, so ntb_netdev neither frees the skb nor takes its enqueue error path and the buffer leaks. Sustained oversized traffic over a non-transparent PCIe bridge link drains host memory, which on a GPU node means the OOM killer arriving in the middle of jobs that cannot be cheaply rescheduled. Only hosts that actually use NTB interconnect with ntb_netdev are affected; most GPU fleets use InfiniBand or Ethernet here and never load this driver.

Who can reach it

A peer that can send traffic across the NTB link to the affected host. No authentication exists at this layer; exposure depends entirely on whether ntb_netdev is in use.

What to do

Apply the stable fix that rejects oversized buffers in ntb_transport_tx_enqueue() with -EMSGSIZE (five stable commits linked - take the one for your branch, plus the preceding netdev patch that frees the skb on that error). Kernel update and node reboot. If ntb_transport/ntb_netdev are not loaded, there is nothing to schedule. No fixed version strings are given in the record.

References

Related entries

• Linux kernel SUNRPC: gssx decode error paths NULL-deref and leak group_info on the NFS serverCVE-2026-89544 · Linux kernel nfsd/SUNRPC gssx option-array decoder (gss-proxy upcall)High
• Linux kernel nfsd: transports routed to threadless service pools hang the connection indefinitelyCVE-2026-89549 · Linux kernel SUNRPC svc_pool_for_cpu() (nfsd pool-to-CPU routing)High
• Linux kernel nfsd: broken short-write detection writes the next segment at the wrong file offsetCVE-2026-89678 · Linux kernel nfsd_direct_write() (NFS server direct-I/O write path)High
• Linux kernel nfsd: NFSv4 SETATTR with the special ONE stateid NULL-derefs and oopses the serverCVE-2026-89679 · Linux kernel nfsd4_setattr() (NFSv4 delegated timestamp attributes)High
• Linux kernel nfsd: each failed inter-server COPY leaks an nfsd_file, pinning inode and mountCVE-2026-89680 · Linux kernel nfsd4_copy() (inter-server COPY setup error path)High
• Linux kernel nfsd: race between cpntf publish and OFFLOAD_CANCEL oopses on an uninitialised list headCVE-2026-89684 · Linux kernel nfsd nfs4_alloc_init_cpntf_state() (server-to-server copy stateid IDR)High