---
id: CVE-2026-80862
title: 'nvme-tcp: fix usage of page_frag_cache'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvme-tcp: fix usage of page_frag_cache

  nvme uses page_frag_cache to preallocate PDU for each preallocated request
  of block device. Block devices are created in paralle…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 <
    d19f98c79f1b7e09e4cdf5c20d626e571e487467
  - >-
    Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 <
    64561afb42d8390695bf810d9bbd087cbca00291
  - >-
    Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 <
    0a9750263ffacbbd2048a391fd4bd22e2146c57d
  - >-
    Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 <
    6e4cf281558709b92ec2ca3054fe2ffc69266ef9
  - >-
    Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 <
    36ac05f7cfd59d90c597071304b14e98090d5dd1
  - Linux 6.12
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:44:56.360Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80862'
references:
  - url: 'https://git.kernel.org/stable/c/d19f98c79f1b7e09e4cdf5c20d626e571e487467'
  - url: 'https://git.kernel.org/stable/c/64561afb42d8390695bf810d9bbd087cbca00291'
  - url: 'https://git.kernel.org/stable/c/0a9750263ffacbbd2048a391fd4bd22e2146c57d'
  - url: 'https://git.kernel.org/stable/c/6e4cf281558709b92ec2ca3054fe2ffc69266ef9'
  - url: 'https://git.kernel.org/stable/c/36ac05f7cfd59d90c597071304b14e98090d5dd1'
tags:
  - cve.org
epss: 0.00156
epssPercentile: 0.04353
ingestedAt: '2026-10-19T09:16:01.491Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix usage of page_frag_cache

nvme uses page_frag_cache to preallocate PDU for each preallocated request
of block device. Block devices are created in parallel threads,
consequently page_frag_cache is used in not thread-safe manner.
That leads to incorrect refcounting of backstore pages and premature free.

That can be catched by !sendpage_ok inside network stack:

WARNING: CPU: 7 PID: 467 at ../net/core/skbuff.c:6931 skb_splice_from_iter+0xfa/0x310.
	tcp_sendmsg_locked+0x782/0xce0
	tcp_sendmsg+0x27/0x40
	sock_sendmsg+0x8b/0xa0
	nvme_tcp_try_send_cmd_pdu+0x149/0x2a0
Then random panic may occur.

Fix that by serializing the usage of page_frag_cache.

## Affected

- `Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 < d19f98c79f1b7e09e4cdf5c20d626e571e487467`
- `Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 < 64561afb42d8390695bf810d9bbd087cbca00291`
- `Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 < 0a9750263ffacbbd2048a391fd4bd22e2146c57d`
- `Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 < 6e4cf281558709b92ec2ca3054fe2ffc69266ef9`
- `Linux >= 4e893ca8117022de68ce1b61c0309e3d17bb8a25 < 36ac05f7cfd59d90c597071304b14e98090d5dd1`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.