CVE-2026-63980
Received Received - Intake

Race Condition in Linux Kernel Net/Handshake Component

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spin_lock_bh for hn_lock nvmet_tcp_state_change(), a socket callback that runs in BH context, can reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue() and tls_handshake_cancel(). handshake_req_cancel() acquires hn->hn_lock with plain spin_lock(). If a process-context thread on the same CPU holds hn->hn_lock when a softirq invokes the cancel path, the lock attempt deadlocks. This is the only caller that invokes tls_handshake_cancel() from BH context; every other consumer calls it from process context. Deferring the cancel to process context in the NVMe target is not straightforward: nvmet_tcp_schedule_release_queue() must call tls_handshake_cancel() atomically with its state transition to DISCONNECTING. If the cancel were deferred, the handshake completion callback could fire in the window before the cancel runs, observe the unexpected state, and return without dropping its kref on the queue. Reworking that interlock is considerably more invasive than hardening the handshake lock. Convert all hn->hn_lock acquisitions from spin_lock/spin_unlock to spin_lock_bh/spin_unlock_bh so the lock is never taken with softirqs enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63980
EUVD
EUVD-2026-45753

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a deadlock can occur in the NVMe over TCP (NVMe-TCP) subsystem. The issue arises because a socket callback running in BH (bottom half) context tries to acquire a lock using spin_lock(), which can conflict with a process-context thread holding the same lock on the same CPU. This causes a deadlock when softirqs are enabled.

Detection Guidance

This vulnerability is specific to the Linux kernel's NVMe over TCP implementation and involves a potential deadlock in the handshake lock mechanism. Detection requires checking kernel logs for softirq-related deadlocks or hangs in NVMe-TCP operations. Monitor for kernel messages indicating lock contention or CPU stalls in nvmet_tcp_state_change or handshake_req_cancel paths.

Impact Analysis

If exploited, this vulnerability could lead to system hangs or crashes, particularly in systems using NVMe over TCP. This may cause denial of service, disrupting storage operations and potentially leading to data unavailability or corruption.

Compliance Impact

This vulnerability is a Linux kernel locking issue that could lead to deadlocks in the NVMe over TCP subsystem. It does not directly affect data confidentiality, integrity, or availability in a way that would impact GDPR, HIPAA, or similar standards.

Mitigation Strategies

Apply the kernel patch that converts hn->hn_lock acquisitions from spin_lock to spin_lock_bh. Update to a Linux kernel version that includes this fix. If immediate patching is not possible, avoid using NVMe over TCP (nvmet_tcp) until the fix is applied to prevent potential deadlock scenarios.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63980. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart