UBUNTU-CVE-2026-80862: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of pagefragcache nvme uses pagefragcache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently pagefragcache is used in not thread-safe manner. That leads to incorrect refcounting of backstore pages and premature free. That can be catched by !sendpageok inside network stack: WARNING: CPU: 7 PID: 467 at ../net/core/skbuff.c:6931 skbsplicefromiter+0xfa/0x310. tcpsendmsglocked+0x782/0xce0 tcpsendmsg+0x27/0x40 socksendmsg+0x8b/0xa0 nvmetcptrysendcmdpdu+0x149/0x2a0 Then random panic may occur. Fix that by serializing the usage of pagefragcache.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Serialize usage of page_frag_cache in nvme-tcp so it is not accessed concurrently by parallel block-device creation threads.
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are identified as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What conditions are needed to trigger the issue?
The issue is associated with the NVMe-over-TCP path and concurrent creation of block devices. Parallel use of the shared page_frag_cache can cause incorrect backing-page reference counts and premature page freeing.
How might an affected system present?
Systems may emit a !sendpage_ok warning from the network stack, including skb_splice_from_iter, tcp_sendmsg_locked, tcp_sendmsg, sock_sendmsg, and nvme_tcp_try_send_cmd_pdu in the stack trace. A random kernel panic may subsequently occur.