Improper use of the page_frag_cache in the Linux kernel’s nvme‑tcp module creates a race condition when block devices are instantiated from multiple threads. The race results in incorrect reference counting of backstore pages and premature freeing of memory, which can trigger a kernel panic via the network stack’s sendpage logic. The failure manifests as a denial‑of‑service condition where the entire system becomes unresponsive.

All Linux kernel versions that include the nvme‑tcp driver and use the page_frag_cache for preallocating PDUs prior to the fix are affected. The vendor designation is Linux:Linux, and the change applies to the kernel’s nvme‑tcp implementation with no specific version overrides listed. Users running a kernel before the commit that serializes access to page_frag_cache are at risk.

The CVSSL score is not provided, and the exploit probability (EPSS) is unavailable, but the analysis shows that the flaw can cause a kernel crash without complex prerequisites. An attacker may trigger the crash by inducing concurrent NVMe over TCP operations, which makes the vulnerability highly exploitable from local or potentially remote context that can leverage NVMe traffic. The issue is not currently listed in the CISA KEV catalog, but its impact warrants urgent attention.