{"id":"CVE-2026-80862","title":"nvme-tcp: fix usage of page_frag_cache","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix usage of page_frag_cache\n\nnvme uses page_frag_cache to preallocate PDU for each preallocated request\nof block device. Block devices are created in paralle…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 < d19f98c79f1b7e09e4cdf5c20d626e571e487467","Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 < 64561afb42d8390695bf810d9bbd087cbca00291","Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 < 0a9750263ffacbbd2048a391fd4bd22e2146c57d","Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 < 6e4cf281558709b92ec2ca3054fe2ffc69266ef9","Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 < 36ac05f7cfd59d90c597071304b14e98090d5dd1","Linux 6.12"],"published":"2026-09-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:44:56.360Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80862","references":[{"url":"https://git.kernel.org/stable/c/d19f98c79f1b7e09e4cdf5c20d626e571e487467"},{"url":"https://git.kernel.org/stable/c/64561afb42d8390695bf810d9bbd087cbca00291"},{"url":"https://git.kernel.org/stable/c/0a9750263ffacbbd2048a391fd4bd22e2146c57d"},{"url":"https://git.kernel.org/stable/c/6e4cf281558709b92ec2ca3054fe2ffc69266ef9"},{"url":"https://git.kernel.org/stable/c/36ac05f7cfd59d90c597071304b14e98090d5dd1"}],"tags":["cve.org"],"epss":0.00156,"epssPercentile":0.04353,"ingestedAt":"2026-10-19T09:16:01.491Z","slug":"CVE-2026-80862","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix usage of page_frag_cache\n\nnvme uses page_frag_cache to preallocate PDU for each preallocated request\nof block device. Block devices are created in parallel threads,\nconsequently page_frag_cache is used in not thread-safe manner.\nThat leads to incorrect refcounting of backstore pages and premature free.\n\nThat can be catched by !sendpage_ok inside network stack:\n\nWARNING: CPU: 7 PID: 467 at ../net/core/skbuff.c:6931 skb_splice_from_iter+0xfa/0x310.\n\ttcp_sendmsg_locked+0x782/0xce0\n\ttcp_sendmsg+0x27/0x40\n\tsock_sendmsg+0x8b/0xa0\n\tnvme_tcp_try_send_cmd_pdu+0x149/0x2a0\nThen random panic may occur.\n\nFix that by serializing the usage of page_frag_cache.\n\n## Affected\n\n- `Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 < d19f98c79f1b7e09e4cdf5c20d626e571e487467`\n- `Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 < 64561afb42d8390695bf810d9bbd087cbca00291`\n- `Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 < 0a9750263ffacbbd2048a391fd4bd22e2146c57d`\n- `Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 < 6e4cf281558709b92ec2ca3054fe2ffc69266ef9`\n- `Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 < 36ac05f7cfd59d90c597071304b14e98090d5dd1`\n- `Linux 6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}