TCP stream corruption via nested page-fragment reuse

Memory corruption in the Linux kernel allows remote attackers to corrupt TCP streams through a page fault in an mmap-backed send buffer. When tcp_sendmsg_locked faults while copying the mapped buffer, the fault handler performs an SMB transaction on another socket in the same process context; that nested allocation silently replaces the task page fragment still used by the outer send operation. The demonstrated gate is an HTTP server sending an mmap-backed file from a CIFS mount; public records establish corrupted outbound data but not code execution or persistent file modification.