CVE-2026-80862: nvme-tcp: fix usage of page_frag_cache
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: fix usage of pagefragcache
nvme uses pagefragcache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently pagefragcache is used in not thread-safe manner. That leads to incorrect refcounting of backstore pages and premature free.
That can be catched by !sendpageok inside network stack:
WARNING: CPU: 7 PID: 467 at ../net/core/skbuff.c:6931 skbsplicefromiter+0xfa/0x310. tcpsendmsglocked+0x782/0xce0 tcpsendmsg+0x27/0x40 socksendmsg+0x8b/0xa0 nvmetcptrysendcmdpdu+0x149/0x2a0 Then random panic may occur.
Fix that by serializing the usage of pagefragcache.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel NVMe/TCP path are exposed when block devices are created in parallel threads. The race occurs because the shared page_frag_cache is used without thread-safe serialization during preallocation of request PDUs.
What is the practical impact of triggering the race?
Incorrect reference counting can prematurely free backstore pages. The network stack may report a !sendpage_ok warning, and the system can subsequently panic at random.
How can administrators identify a potentially affected system?
Kernel logs may contain a WARNING from skb_splice_from_iter in net/core/skbuff.c, with a call chain including tcp_sendmsg_locked, sock_sendmsg, and nvme_tcp_try_send_cmd_pdu. Random panics in this path are also an indicator.
What is the remediation?
Apply a kernel update containing the NVMe/TCP change that serializes use of page_frag_cache. The provided stable-kernel references identify commits carrying the fix.