Executive brief
NVMe-TCP is a storage driver used to connect Linux systems to NVMe storage devices over TCP networks. A race condition in memory allocation can cause incorrect reference counting of memory pages, leading to use-after-free conditions and random system crashes when multiple threads initialize storage devices simultaneously. This affects the stability and availability of systems relying on NVMe-TCP storage connectivity.
Technical details
The vulnerability is a race condition (CWE-362) in the nvme-tcp driver's use of page_frag_cache, a thread-unsafe memory allocation cache. When block devices are created in parallel threads, concurrent calls to page_frag_alloc() within nvme_tcp_init_request() and nvme_tcp_alloc_async_req() corrupt the cache's internal state, leading to incorrect page reference counts and premature page freeing. This causes the network stack to detect invalid pages via !sendpage_ok checks and subsequently triggers kernel panics. The fix adds mutex serialization (pf_cache_lock) around all page_frag_alloc() calls in the affected functions. This is a local kernel bug triggered during normal multi-threaded device initialization; no network attack vector is required.
Affected products
- Linux Linux kernel All versions affected by commit 4e893ca81170 (nvme_core: scan namespaces asynchronously); patched in mainline as of commit 36ac05f7cfd59d90c597071304b14e98090d5dd1 and backported to stable branches
Timeline
- 2026-09-04: disclosed: CVE published
- 2026-08-11: patched: Mainline patch commit 36ac05f7cfd59d90c597071304b14e98090d5dd1
- 2026-09-02: other: Backported to stable kernel branches