CVE-2026-63980

A flaw was found in the Linux kernel's network handshake component. An improper locking mechanism, specifically the use of spin_lock() instead of spin_lock_bh() in the handshake_req_cancel() function, can lead to a deadlock. This vulnerability occurs when a process-context thread holds a lock while a softirq attempts to acquire the same lock, resulting in a system freeze. This can ultimately cause a Denial of Service (DoS) condition, making the system unresponsive.

A deadlock can occur in the net handshake layer because hn_lock was taken with plain spin_lock while tls_handshake_cancel can be reached from BH context through nvmet_tcp_state_change. If a process context thread on the same CPU already holds hn_lock with softirqs enabled, the softirq cancel path can spin on the same lock and stall the CPU or the affected networking path. For the CVSS the PR:N is used because a remote peer may only need reachability to the exposed NVMe/TCP TLS target path, not local code execution on the victim. The attack vector is treated as AV:A rather than AV:N because NVMe/TCP targets are normally deployed on local or trusted storage networks. Impact is denial of service due to deadlock or soft lockup. No UAF, OOB access, information disclosure, or privilege escalation primitive is indicated by the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.