nvme-tcp: fix usage of page_frag_cache

Answer in brief

CVE-2026-80862 records a Unknown severity vulnerability in nvme-tcp: fix usage of page_frag_cache. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 4, 2026Updated Sep 4, 2026Source checked Sep 4, 2026First seen by HOL Sep 4, 2026Material review Sep 4, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=4e893ca8117022de68ce1b61c0309e3d17bb8a25 <d19f98c79f1b7e09e4cdf5c20d626e571e487467 \|\| >=4e893ca8117022de68ce1b61c0309e3d17bb8a25 <64561afb42d8390695bf810d9bbd087cbca00291 \|\| >=4e893ca8117022de68ce1b61c0309e3d17bb8a25 <0a9750263ffacbbd2048a391fd4bd22e2146c57d \|\| >=4e893ca8117022de68ce1b61c0309e3d17bb8a25 <6e4cf281558709b92ec2ca3054fe2ffc69266ef9 \|\| >=4e893ca8117022de68ce1b61c0309e3d17bb8a25 <36ac05f7cfd59d90c597071304b14e98090d5dd1	d19f98c79f1b7e09e4cdf5c20d626e571e487467, 64561afb42d8390695bf810d9bbd087cbca00291, 0a9750263ffacbbd2048a391fd4bd22e2146c57d, 6e4cf281558709b92ec2ca3054fe2ffc69266ef9, 36ac05f7cfd59d90c597071304b14e98090d5dd1
Linux/Linuxgeneric	6.12	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to d19f98c79f1b7e09e4cdf5c20d626e571e487467 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 4, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of page_frag_cache nvme uses page_frag_cache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently page_frag_cache is used in not thread-safe manner. That leads to incorrect refcounting of backstore pages and premature free. That can be catched by !sendpage_ok inside network stack: WARNING: CPU: 7 PID: 467 at ../net/core/skbuff.c:6931 skb_splice_from_iter+0xfa/0x310. tcp_sendmsg_locked+0x782/0xce0 tcp_sendmsg+0x27/0x40 sock_sendmsg+0x8b/0xa0 nvme_tcp_try_send_cmd_pdu+0x149/0x2a0 Then random panic may occur. Fix that by serializing the usage of page_frag_cache.

Quoted source text, attributed separately from HOL analysis.