CVE-2026-80884

What it actually does

The flaw permits the DMA handle returned by allocation to be modified before being passed to dma_free_attrs, violating the DMA API requirement that the exact original handle must be supplied and enabling memory corruption on deallocation.

Why it matters to the business

Kernel memory management errors on affected Linux systems can produce crashes, data corruption, or privilege-escalation opportunities, causing unplanned downtime and requiring urgent patching across server fleets.

How an attack unfolds

An attacker with local or adjacent access to trigger NTB DMA paths supplies input that causes the driver to alter the stored DMA address before the corresponding free operation, resulting in invalid deallocation and subsequent memory-safety violations.

How to fix it

Update the Linux kernel to a version containing the ntb fix that stores and reuses the original DMA address; rebuild and reboot with the corrected driver.

How to confirm the fix worked

Inspect the ntb source for the commit that preserves the original dma_handle, run DMA allocation/free stress tests, and confirm no mismatched-handle warnings appear in kernel logs.

Typical attack path

1. Locate Linux hosts exposing NTB hardware or drivers
2. Trigger DMA allocation through NTB interfaces
3. Manipulate state so the handle is modified before free
4. Force deallocation with the altered handle to corrupt kernel memory

How to detect it

Search kernel logs and crash dumps for ntb-related DMA address mismatch warnings, unexpected oops in dma_free_attrs, or memory corruption traces involving the NTB driver.

What your security team should do

• Apply the upstream ntb DMA-address fix to all kernels within 30 days
• Inventory hosts using the ntb module and schedule staged rollouts
• Add kernel DMA error monitoring to existing SIEM rules