CVE-2026-80862: nvme-tcp: fix usage of page_frag_cache

Published Sep 4, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix usage of pagefragcache

nvme uses pagefragcache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently pagefragcache is used in not thread-safe manner. That leads to incorrect refcounting of backstore pages and premature free.

That can be catched by !sendpageok inside network stack:

WARNING: CPU: 7 PID: 467 at ../net/core/skbuff.c:6931 skbsplicefromiter+0xfa/0x310. tcpsendmsglocked+0x782/0xce0 tcpsendmsg+0x27/0x40 socksendmsg+0x8b/0xa0 nvmetcptrysendcmdpdu+0x149/0x2a0 Then random panic may occur.

Fix that by serializing the usage of pagefragcache.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 4, 2026
CVE Published
via MITRE·03:55 PM
Data Sourced
via MITRE·03:55 PM
Description

Frequently Asked Questions

1

Which systems are exposed to this issue?

Systems using the Linux kernel NVMe/TCP path are exposed when block devices are created in parallel threads. The race occurs because the shared page_frag_cache is used without thread-safe serialization during preallocation of request PDUs.

2

What is the practical impact of triggering the race?

Incorrect reference counting can prematurely free backstore pages. The network stack may report a !sendpage_ok warning, and the system can subsequently panic at random.

3

How can administrators identify a potentially affected system?

Kernel logs may contain a WARNING from skb_splice_from_iter in net/core/skbuff.c, with a call chain including tcp_sendmsg_locked, sock_sendmsg, and nvme_tcp_try_send_cmd_pdu. Random panics in this path are also an indicator.

4

What is the remediation?

Apply a kernel update containing the NVMe/TCP change that serializes use of page_frag_cache. The provided stable-kernel references identify commits carrying the fix.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203