CVE-2026-80862: Linux Kernel NVME-TCP Race Condition Flaw

CVE-2026-80862 Overview

CVE-2026-80862 is a race condition in the Linux kernel's nvme-tcp driver. The NVMe over TCP transport uses page_frag_cache to preallocate Protocol Data Units (PDUs) for each preallocated request of a block device. Block devices are created in parallel threads, causing page_frag_cache to be accessed without thread safety. The result is incorrect reference counting of backstore pages and premature memory frees.

The issue surfaces as a warning in skb_splice_from_iter inside the network stack, followed by potential random kernel panics. Upstream maintainers have merged fixes across multiple stable branches to serialize access to page_frag_cache.

Critical Impact
Concurrent initialization of NVMe/TCP block devices can trigger memory corruption in the network send path, leading to kernel warnings and unpredictable panics.

Affected Products

Linux kernel nvme-tcp driver (multiple stable branches, per upstream commits)
Systems using NVMe over Fabrics with the TCP transport
Linux distributions shipping vulnerable kernel versions prior to backported fixes

Discovery Timeline

2026-09-04 - CVE-2026-80862 published to the National Vulnerability Database (NVD)
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80862

Vulnerability Analysis

The nvme-tcp driver preallocates one PDU buffer per request when a block device is registered. Buffers are drawn from page_frag_cache, a per-cache allocator that maintains a running reference count on the backing page. This allocator is not internally synchronized and assumes callers provide serialization.

When multiple NVMe/TCP block devices are created in parallel, kernel threads invoke the allocator concurrently against the same cache instance. Concurrent updates to the fragment offset and page refcount race with each other. Reference counts drift, and a backing page is released while pointers to fragments within it remain in use as PDU buffers.

The corruption is detected downstream in the TCP send path. When tcp_sendmsg_locked calls skb_splice_from_iter, the sendpage_ok check rejects pages whose refcounts indicate they are no longer valid for zero-copy splice, producing a WARNING at net/core/skbuff.c:6931. Following that warning, freed memory may be reused, causing unpredictable panics.

Root Cause

The root cause is unsynchronized use of a non-thread-safe allocator [CWE-362, race condition class]. page_frag_cache requires external locking, but the nvme-tcp initialization path invoked it from parallel device-creation threads without any mutex or per-CPU partitioning. The fix serializes access to the cache during PDU preallocation.

Attack Vector

This is a local, non-authenticated reliability and memory-safety defect triggered by legitimate storage configuration workflows. Any workload that provisions multiple NVMe/TCP block devices concurrently, such as orchestrated container storage attach or bulk namespace onboarding, can reach the race window. Triggering the fault does not require network-side input, and no remote exploitation path is documented in the upstream advisory.

See the upstream commits for the technical patch details: Kernel commit 0a97502, Kernel commit 36ac05f, Kernel commit 64561af, Kernel commit 6e4cf28, and Kernel commit d19f98c.

Detection Methods for CVE-2026-80862

Indicators of Compromise

Kernel WARNING at net/core/skbuff.c originating from skb_splice_from_iter+0xfa/0x310 with a call chain including tcp_sendmsg_locked, sock_sendmsg, and nvme_tcp_try_send_cmd_pdu.
Sporadic kernel panics on hosts running NVMe/TCP initiators, particularly during bulk device attach operations.
Unexplained I/O errors or resets on NVMe/TCP namespaces shortly after connect storms.

Detection Strategies

Aggregate kernel ring buffer and journald output centrally and alert on skb_splice_from_iter warnings correlated with nvme_tcp_* symbols.
Track kernel version and nvme-tcp module version across the fleet, flagging hosts on branches that predate the upstream fixes.
Correlate NVMe/TCP connect operations with subsequent kernel warnings to identify the race window empirically.

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log platform with parsing for stack traces.
Monitor for host reboots or kernel oops events on storage initiators and pivot to preceding NVMe/TCP activity.
Track NVMe subsystem controller states (live, resetting, connecting) and alert on rapid transitions.

How to Mitigate CVE-2026-80862

Immediate Actions Required

Inventory hosts running the NVMe/TCP initiator and identify kernels lacking the upstream serialization fix.
Upgrade to a kernel that includes the referenced stable commits for your maintained branch.
Where patching is not immediately feasible, serialize NVMe/TCP device creation to a single thread.

Patch Information

The fix serializes usage of page_frag_cache in the nvme-tcp PDU preallocation path. Patches are available in the upstream stable tree at commit 0a97502, commit 36ac05f, commit 64561af, commit 6e4cf28, and commit d19f98c. Apply the vendor kernel update from your Linux distribution that incorporates these commits and reboot affected hosts.

Workarounds

Provision NVMe/TCP block devices sequentially rather than in parallel to avoid concurrent allocator access.
Where possible, switch storage transports (for example NVMe over RDMA or iSCSI) on affected hosts until the kernel is patched.
Reduce concurrency in orchestration tooling that performs bulk nvme connect operations against the same host.

bash

# Verify kernel version and nvme module before and after patching
uname -r
modinfo nvme_tcp | grep -E '^(version|srcversion|filename):'

# Confirm the fix is present by checking installed kernel package changelog
# Example for RHEL-family systems
rpm -q --changelog kernel | grep -i 'nvme-tcp' | head

# Example for Debian-family systems
apt-get changelog linux-image-$(uname -r) | grep -i 'nvme-tcp' | head