CVE-2026-80987

In the Linux kernel, the following vulnerability has been resolved:

NTB: ntb_transport: Reject oversized TX buffers

ntb_process_tx() handles an oversized buffer by calling tx_handler()

with a NULL data pointer and returning success. ntb_netdev therefore

neither frees the skb in its completion callback nor takes its enqueue

error path, leaking it.

Reject oversized buffers in ntb_transport_tx_enqueue() before acquiring

a queue entry and return -EMSGSIZE. The caller retains ownership of the

buffer, and the preceding netdev patch frees the skb when enqueue

returns this permanent error.