CVE-2026-80884: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-80884 is a memory management vulnerability in the Linux kernel's NTB (Non-Transparent Bridge) subsystem, where the code fails to preserve the original DMA address returned by the allocation function before passing it to dma_free_attrs for deallocation. The DMA API requires that dma_free_attrs receive the exact dma_handle originally returned by the allocation function; modifying it before deallocation can result in incorrect memory release. The vulnerability was published on September 4, 2026, and affects Linux kernel versions from 4.20 onward, with fixes available in stable commits 10662aafce4a and da6d997ac556 (GitHub Advisory). No CVSS score has been formally assigned; Feedly estimates the severity as Medium (GitHub Advisory).

The root cause is improper handling of DMA memory addresses in the Linux kernel NTB subsystem (CWE classification not formally assigned). Specifically, the code modifies the dma_handle value after it is returned by the DMA allocation function, then passes the modified address to dma_free_attrs, violating the DMA API contract which requires the exact original handle. This can result in deallocation of the wrong memory region, potentially triggering a use-after-free condition or memory corruption within the kernel. The vulnerability is locally exploitable and requires access to NTB device operations (GitHub Advisory).

A local user with access to NTB device operations can trigger incorrect DMA memory deallocation, potentially causing a use-after-free condition or memory corruption within the kernel. Consequences may include kernel crashes (denial of service) or, in more severe scenarios, privilege escalation if the corrupted memory region can be controlled by an attacker. The impact is confined to systems with NTB hardware and kernel versions from 4.20 up to the patched commits (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to a system with NTB hardware, significantly limiting the attack surface.

Apply the upstream Linux kernel patches that store the original DMA address and use it unmodified for dma_free_attrs calls. The fixes are available in stable commits 10662aafce4a and da6d997ac556. Users should update to a patched kernel version (7.1.5+ for the 7.1 branch, or 7.2+) as soon as their distribution makes it available (GitHub Advisory). Systems without NTB hardware are not affected and require no action.