Deadlock Vulnerability in Linux Kernel for NVMe TCP Handshake

CVE-2026-63980

What is CVE-2026-63980?

A deadlock vulnerability exists in the Linux kernel related to the NVMe TCP handshake process. The issue arises when the hn_lock is acquired in an improper context, specifically when a socket callback running in Bottom Half (BH) context attempts to acquire the lock held by a thread in process context, leading to potential deadlocks. This situation occurs during the execution of the handshake request cancellation process. Converting lock acquisition from spin_lock to spin_lock_bh prevents such deadlocks by ensuring the lock is never taken with softirqs enabled, enhancing the overall reliability of the NVMe TCP connections.

References