CVE-2026-23179

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()

When the socket is closed while in TCP_LISTEN a callback is run to flush all outstanding packets, which in turns calls nvmet_tcp_listen_data_ready() with the sk_callback_lock held. So we need to check if we are in TCP_LISTEN before attempting to get the sk_callback_lock() to avoid a deadlock.

A deadlock can occur in the NVMe TCP target listen path because nvmet_tcp_listen_data_ready may try to take sk_callback_lock even when it is invoked from a socket close flush callback that already holds the same lock. If this happens the accept work can stall and the target may stop accepting new connections which results in a denial of service. For the CVSS the PR:N choice in the paranoid score assumes the attacker only needs network reachability to the NVMe TCP target listener. The issue is network reachable when the nvmet tcp port is exposed. Impact is denial of service through a stuck listen callback and blocked connection handling.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.