CVE-2026-80862
Received Received - Intake

Race Condition in Linux Kernel NVMe-TCP Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of page_frag_cache nvme uses page_frag_cache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently page_frag_cache is used in not thread-safe manner. That leads to incorrect refcounting of backstore pages and premature free. That can be catched by !sendpage_ok inside network stack: WARNING: CPU: 7 PID: 467 at ../net/core/skbuff.c:6931 skb_splice_from_iter+0xfa/0x310. tcp_sendmsg_locked+0x782/0xce0 tcp_sendmsg+0x27/0x40 sock_sendmsg+0x8b/0xa0 nvme_tcp_try_send_cmd_pdu+0x149/0x2a0 Then random panic may occur. Fix that by serializing the usage of page_frag_cache.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80862
EUVD
EUVD-2026-71312

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect usage of page_frag_cache in the nvme-tcp driver. The nvme driver preallocates PDUs for block device requests using page_frag_cache, but this is done in parallel threads without thread-safe handling. This leads to incorrect refcounting of backstore pages and premature freeing of memory, which can cause system panics.

Detection Guidance

This vulnerability may trigger a kernel warning or panic visible in system logs. Check for messages like 'WARNING: CPU: PID at skb_splice_from_iter' or 'nvme_tcp_try_send_cmd_pdu' in dmesg or journalctl output. No specific commands are provided in the context to detect it directly.

Impact Analysis

This vulnerability can cause random system panics due to memory corruption. If exploited, it may lead to kernel crashes, data corruption, or denial of service. Systems using NVMe over TCP, especially those with high I/O workloads, are at higher risk.

Mitigation Strategies

Apply the Linux kernel patch that fixes the nvme-tcp page_frag_cache usage issue. Update to a kernel version containing the fix. Monitor system logs for related warnings or panics after applying the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80862. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart