CVE-2026-63980

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A deadlock occurs in the Linux kernel when nvmet tcp state change() (a socket callback running in Bottom Half (BH) context) triggers handshake req cancel() via nvmet tcp schedule release queue() and tls handshake cancel(). The issue arises because handshake req cancel() uses a plain spin lock() to acquire hn->hn lock. If a process-context thread on the same CPU already holds hn->hn lock when a softirq invokes the cancel path, the system deadlocks. Bottom Half (BH) context refers to a mechanism in the Linux kernel used to defer non-critical work from interrupt handlers to be processed later.

Recommendations Convert all hn->hn lock acquisitions from spin lock/spin unlock to spin lock bh/spin unlock bh to ensure the lock is never acquired while softirqs are enabled.