PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-80884 Linux CVE debrief

The Linux kernel has a vulnerability in the ntb (Non-Transparent Bridging) component. The DMA API requires that dma_free_attrs receive the exact dma_handle originally returned by the allocation function. This vulnerability affects Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems. The vulnerability has been resolved by storing the original DMA address for future release. Affected product deployments should be reviewed for exposure and patched or mitigated accordingly.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-04
Original CVE updated
2026-10-15
Advisory published
2026-09-04
Advisory updated
2026-10-15

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, users of Linux-based systems, and security teams responsible for vulnerability management and patching. These stakeholders should review the Linux kernel's ntb component code to ensure that the original DMA address is stored for future release and verify that the Linux kernel version is not affected by this vulnerability.

Why it matters

The Linux kernel's ntb component has a vulnerability that has been resolved by storing the original DMA address for future release. This vulnerability affects Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems.

  • Verify that the Linux kernel version is not affected by this vulnerability.
  • Apply the patch to store the original DMA address for future release.
  • Review the Linux kernel's ntb component code to ensure that the original DMA address is stored for future release.

Technical summary

The Linux kernel's ntb component has a vulnerability that has been resolved by storing the original DMA address for future release. The DMA API requires that dma_free_attrs receive the exact dma_handle originally returned by the allocation function. This vulnerability affects Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems. The affected product context includes Linux kernel versions that have not been patched. Defensive impact includes verifying that the Linux kernel version is not affected by this vulnerability and applying the patch to store the original DMA address for future release.

Defensive priority

Medium

Recommended defensive actions

  • Review the Linux kernel's ntb component code to ensure that the original DMA address is stored for future release.
  • Verify that the Linux kernel version is not affected by this vulnerability.
  • Apply the patch to store the original DMA address for future release.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide information about the vulnerability and its resolution. The Linux kernel's ntb component has a vulnerability that has been resolved by storing the original DMA address for future release.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-80884 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-80884

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-80884 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-80884

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • ntb: Store original DMA address for future release

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/80xxx/CVE-2026-80884.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0f035333e19944f8ea7a423681f161eb1b2db21c

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/10662aafce4acd52278c942d0a5b3993594017b9

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/da6d997ac556479c112554ab5d95cbd04683eb11

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.