{"id":"CVE-2026-80862","revision":"a29a43003f02497b9aec15d2460d81e6","records":[{"revision":"a29a43003f02497b9aec15d2460d81e6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80862","aliases":[],"title":"nvme-tcp: fix usage of page_frag_cache","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix usage of page_frag_cache\n\nnvme uses page_frag_cache to preallocate PDU for each preallocated request\nof block device. Block devices are created in parallel threads,\nconsequently page_frag_cache is used in not thread-safe manner.\nThat leads to incorrect refcounting of backstore pages and premature free.\n\nThat can be catched by !sendpage_ok inside network stack:\n\nWARNING: CPU: 7 PID: 467 at ../net/core/skbuff.c:6931 skb_splice_from_iter+0xfa/0x310.\n\ttcp_sendmsg_locked+0x782/0xce0\n\ttcp_sendmsg+0x27/0x40\n\tsock_sendmsg+0x8b/0xa0\n\tnvme_tcp_try_send_cmd_pdu+0x149/0x2a0\nThen random panic may occur.\n\nFix that by serializing the usage of page_frag_cache.","state":0,"publishedAt":"2026-09-04T15:55:16.653+00:00","modifiedAt":"2026-10-21T12:47:08.178+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/nvme/host/tcp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4e893ca8117022de68ce1b61c0309e3d17bb8a25\",\n                            \"lessThan\": \"d19f98c79f1b7e09e4cdf5c20d626e571e487467\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4e893ca8117022de68ce1b61c0309e3d17bb8a25\",\n                            \"lessThan\": \"64561afb42d8390695bf810d9bbd087cbca00291\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4e893ca8117022de68ce1b61c0309e3d17bb8a25\",\n                            \"lessThan\": \"0a9750263ffacbbd2048a391fd4bd22e2146c57d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4e893ca8117022de68ce1b61c0309e3d17bb8a25\",\n                            \"lessThan\": \"6e4cf281558709b92ec2ca3054fe2ffc69266ef9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4e893ca8117022de68ce1b61c0309e3d17bb8a25\",\n                            \"lessThan\": \"36ac05f7cfd59d90c597071304b14e98090d5dd1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c57506918b078ecab7dedebef0f34dbc23ae2e46\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThan\": \"6.7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/nvme/host/tcp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.108\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.49\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.13\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.3\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/d19f98c79f1b7e09e4cdf5c20d626e571e487467","https://git.kernel.org/stable/c/64561afb42d8390695bf810d9bbd087cbca00291","https://git.kernel.org/stable/c/0a9750263ffacbbd2048a391fd4bd22e2146c57d","https://git.kernel.org/stable/c/6e4cf281558709b92ec2ca3054fe2ffc69266ef9","https://git.kernel.org/stable/c/36ac05f7cfd59d90c597071304b14e98090d5dd1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80862","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80862","identifiers":["CVE-2026-80862"]},"retained":false,"historicalAffected":[]}],"coverage":[]}