In the Linux kernel, the following vulnerability has been resolved:

NTB: ntb transport: Reject oversized TX buffers

ntb process tx() handles an oversized buffer by calling tx handler() with a NULL data pointer and returning success. ntb netdev therefore neither frees the skb in its completion callback nor takes its enqueue error path, leaking it.

Reject oversized buffers in ntb transport tx enqueue() before acquiring a queue entry and return -EMSGSIZE. The caller retains ownership of the buffer, and the preceding netdev patch frees the skb when enqueue returns this permanent error.