CVE-2026-80884 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
ntb: Store original DMA address for future release
The DMA API requires that dma_free_attrs receive the exact dma_handle originally returned by the allocation function. Do not modify it.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
This security advisory addresses a critical memory management flaw within the Non-Transparent Bridge (NTB) subsystem of the Linux kernel, specifically concerning the handling of Direct Memory Access DMA handles. The vulnerability stems from an improper modification of the DMA address value during its lifecycle, which violates fundamental requirements established by the kernel's DMA API specification. In systems utilizing NTB technology for high-performance interconnects between PCIe devices and host processors, accurate memory mapping is essential for data integrity and system stability. The flaw occurs when software alters the dma_handle variable after it has been returned by an allocation function such as dma_alloc_attrs or similar variants. According to strict kernel programming guidelines, any subsequent deallocation via dma_free_attrs must utilize the exact handle originally provided at allocation time. Deviating from this requirement introduces undefined behavior that can compromise system reliability and potentially expose security vulnerabilities related to memory corruption.
The technical root cause lies in a logic error where the DMA address is modified before being passed back for release operations. This modification might result from incorrect pointer arithmetic, unintended type casting, or failure to preserve the original reference returned by the hardware abstraction layer. When dma_free_attrs receives an altered handle rather than the exact one issued during allocation, it fails to correctly identify and unmap the associated physical memory pages. Consequently, this mismatch prevents the kernel from properly releasing resources back to the system pool. Over time, such failures contribute to resource leaks where allocated DMA buffers remain mapped but inaccessible for legitimate use, leading to gradual degradation of available memory bandwidth and potential exhaustion of DMA address space on systems with limited IOMMU capabilities or strict addressing constraints.
From an operational impact perspective, this vulnerability primarily manifests as a denial of service condition through resource exhaustion rather than immediate privilege escalation or remote code execution. However, the implications extend beyond simple performance degradation. Incorrectly freed memory regions can lead to use-after-free scenarios if other subsystems attempt to access stale pointers that were not properly invalidated due to the failed deallocation process. Furthermore, in environments where multiple devices share DMA resources through NTB links, improper handling of these handles can cause data corruption across device boundaries. Attackers with local access could potentially exploit this instability by triggering repeated allocation and failure cycles to exhaust system memory or destabilize kernel operations, thereby achieving a denial-of-service state against critical services running on the affected host.
This issue aligns closely with CWE-401, which describes missing release of memory after effective lifetime, as well as CWE-787, out-of-bounds write, if the altered handle leads to writing into unintended physical addresses during subsequent operations that assume valid mappings. In terms of attack vector classification under MITRE ATT&CK, this vulnerability falls under T1496 Resource Hijacking, specifically within the subcategory of Network Service Scavenging or System Resource Exhaustion, as it allows an adversary to consume system resources through improper API usage patterns. While typically requiring local access to trigger repeatedly, the underlying flaw represents a significant deviation from secure coding practices mandated by kernel maintainers and industry standards for robust driver development.
Mitigation strategies focus on ensuring strict adherence to DMA API conventions within device drivers and subsystem codebases. Developers must verify that all calls to dma_free_attrs are passed the exact handle returned by their corresponding allocation functions without any intermediate modifications, transformations, or pointer arithmetic adjustments unless explicitly documented as safe by the architecture-specific implementation details. Code reviews should prioritize checking for these patterns in NTB-related modules and other high-throughput interconnect drivers. Additionally, enabling kernel debugging features such as DMA-API debug can help identify mismatches during development phases before deployment to production environments. System administrators running affected kernels should apply vendor-provided patches that correct the handle preservation logic within the ntb subsystem code path. Regular updates to the Linux kernel are essential to maintain compliance with these critical memory management standards and prevent potential resource exhaustion attacks or stability issues arising from improper DMA handle handling.