Cloudanix VulnDB

CVE-2026-80862

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the Linux kernel's handling of certain storage connections over networks can cause computers to crash unexpectedly under heavy or parallel workloads.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in nvme-tcp where page_frag_cache is accessed concurrently from parallel block device creation threads without synchronization, resulting in incorrect page refcounting, premature page frees, and kernel panics during PDU transmission in the network stack.

Why it matters to the business

Systems using NVMe over TCP for storage may experience unexpected crashes, storage I/O failures, and reduced availability, with higher urgency in environments relying on high-throughput block devices or parallel device initialization.

How an attack unfolds

An attacker with local access triggers concurrent NVMe TCP request allocations through crafted workloads or parallel device operations to hit the unsynchronized page_frag_cache usage, causing refcount errors that manifest as network stack warnings and random kernel panics.

How to fix it

Apply the upstream kernel patch that serializes page_frag_cache usage in nvme-tcp; rebuild and deploy updated kernels to all affected systems. Prioritize systems with NVMe-TCP configurations.

How to confirm the fix worked

Confirm the fix by inspecting nvme-tcp source for added serialization around page_frag_cache; test under concurrent device creation workloads and verify absence of the skb_splice_from_iter warning in dmesg.

Typical attack path

  1. Obtain local execution or workload control on a system with nvme-tcp enabled
  2. Trigger parallel creation of multiple NVMe block devices or preallocated requests
  3. Force concurrent access to page_frag_cache during PDU preallocation
  4. Induce network transmission paths that call into skb_splice_from_iter
  5. Observe refcount mismatch leading to warning and subsequent panic

How to detect it

Search kernel logs and dmesg for WARNING messages referencing skb_splice_from_iter, tcp_sendmsg_locked, or nvme_tcp_try_send_cmd_pdu; correlate with NVMe-TCP device creation events.

  • WARNING: CPU:.*at .*net/core/skbuff.c.*skb_splice_from_iter
  • nvme_tcp_try_send_cmd_pdu
  • tcp_sendmsg_locked.*nvme

What your security team should do

  • Immediately identify and patch all Linux kernels supporting nvme-tcp
  • Monitor kernel logs for skb_splice_from_iter and nvme_tcp_try_send_cmd_pdu warnings
  • Restrict local access and limit concurrent storage device initialization where possible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of page_frag_cache nvme uses page_frag_cache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently page_frag_cache is used in not thread-safe manner. That leads to incorrect refcounting of backstore pages and premature free. That can be catched by !sendpage_ok inside network stack: WARNING: CPU: 7 PID: 467 at ../net/core/skbuff.c:6931 skb_splice_from_iter+0xfa/0x310. tcp_sendmsg_locked+0x782/0xce0 tcp_sendmsg+0x27/0x40 sock_sendmsg+0x8b/0xa0 nvme_tcp_try_send_cmd_pdu+0x149/0x2a0 Then random panic may occur. Fix that by serializing the usage of page_frag_cache.

Affected packages

Ecosystem Package Introduced Fixed