CVE-2026-80862

nvme-tcp: fix usage of page_frag_cache

State: Published
Severity: Not scored
Published: Sep 4, 2026
Updated: Oct 21, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix usage of page_frag_cache

nvme uses page_frag_cache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently page_frag_cache is used in not thread-safe manner. That leads to incorrect refcounting of backstore pages and premature free.

That can be catched by !sendpage_ok inside network stack:

WARNING: CPU: 7 PID: 467 at ../net/core/skbuff.c:6931 skb_splice_from_iter+0xfa/0x310. tcp_sendmsg_locked+0x782/0xce0 tcp_sendmsg+0x27/0x40 sock_sendmsg+0x8b/0xa0 nvme_tcp_try_send_cmd_pdu+0x149/0x2a0 Then random panic may occur.

Fix that by serializing the usage of page_frag_cache.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4e893ca8117022de68ce1b61c0309e3d17bb8a25 to before d19f98c79f1b7e09e4cdf5c20d626e571e487467Affected 4e893ca8117022de68ce1b61c0309e3d17bb8a25 to before 64561afb42d8390695bf810d9bbd087cbca00291Affected 4e893ca8117022de68ce1b61c0309e3d17bb8a25 to before 0a9750263ffacbbd2048a391fd4bd22e2146c57dAffected 4e893ca8117022de68ce1b61c0309e3d17bb8a25 to before 6e4cf281558709b92ec2ca3054fe2ffc69266ef9Affected 4e893ca8117022de68ce1b61c0309e3d17bb8a25 to before 36ac05f7cfd59d90c597071304b14e98090d5dd1Affected c57506918b078ecab7dedebef0f34dbc23ae2e46Affected 6.6.160 to before 6.7Affected
LinuxLinux	6.12Affected before 6.12Not affected 6.12.108 through 6.12.Not affected 6.18.49 through 6.18.Not affected 7.1.13 through 7.1.Not affected 7.2.3 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4e893ca8117022de68ce1b61c0309e3d17bb8a25 to before d19f98c79f1b7e09e4cdf5c20d626e571e487467Affected
4e893ca8117022de68ce1b61c0309e3d17bb8a25 to before 64561afb42d8390695bf810d9bbd087cbca00291Affected
4e893ca8117022de68ce1b61c0309e3d17bb8a25 to before 0a9750263ffacbbd2048a391fd4bd22e2146c57dAffected
4e893ca8117022de68ce1b61c0309e3d17bb8a25 to before 6e4cf281558709b92ec2ca3054fe2ffc69266ef9Affected
4e893ca8117022de68ce1b61c0309e3d17bb8a25 to before 36ac05f7cfd59d90c597071304b14e98090d5dd1Affected
c57506918b078ecab7dedebef0f34dbc23ae2e46Affected
6.6.160 to before 6.7Affected

LinuxLinux

6.12Affected
before 6.12Not affected
6.12.108 through 6.12.*Not affected
6.18.49 through 6.18.*Not affected
7.1.13 through 7.1.*Not affected
7.2.3 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.