CVE-2026-63980

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63980", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.025Z", "datePublished": "2026-07-19T14:56:03.887Z", "dateUpdated": "2026-10-19T20:18:00.627Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:37:51.364Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: Use spin_lock_bh for hn_lock\n\nnvmet_tcp_state_change(), a socket callback that runs in BH context,\ncan reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue()\nand tls_handshake_cancel(). handshake_req_cancel() acquires\nhn->hn_lock with plain spin_lock(). If a process-context thread on\nthe same CPU holds hn->hn_lock when a softirq invokes the cancel path,\nthe lock attempt deadlocks. This is the only caller that invokes\ntls_handshake_cancel() from BH context; every other consumer calls it\nfrom process context.\n\nDeferring the cancel to process context in the NVMe target is not\nstraightforward: nvmet_tcp_schedule_release_queue() must call\ntls_handshake_cancel() atomically with its state transition to\nDISCONNECTING. If the cancel were deferred, the handshake completion\ncallback could fire in the window before the cancel runs, observe the\nunexpected state, and return without dropping its kref on the queue.\nReworking that interlock is considerably more invasive than hardening\nthe handshake lock. Convert all hn->hn_lock acquisitions from\nspin_lock/spin_unlock to spin_lock_bh/spin_unlock_bh so the lock is\nnever taken with softirqs enabled."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable path is reachable through nvmet-tcp, an in-kernel network service that processes remote TCP connections; socket state-change callbacks run in softirq when remote peers disconnect during TLS handshake.\nAC:L - An attacker controls both sides of the race by opening multiple concurrent TLS connections to the NVMe/TCP target and timing abrupt disconnects against in-progress handshake submissions on the same CPU.\nPR:N - Exploitation requires only network access to an NVMe/TCP target port with TLS enabled; the TLS handshake upcall occurs before any NVMe authentication or credentials are verified.\nUI:N - No victim user action is required; the deadlock is triggered entirely by the remote attacker's connection and disconnection timing against the NVMe/TCP service.\nS:U - The deadlock affects kernel availability on the target host but does not cross a security boundary such as a VM guest-to-host escape or sandbox breakout.\nC:N - This is a spinlock deadlock with no memory corruption, out-of-bounds access, or use-after-free; no information disclosure occurs.\nI:N - The vulnerability causes a CPU hang via lock deadlock but does not modify data or enable arbitrary writes or code execution.\nA:H - A spinlock deadlock between process context and softirq causes CPU soft lockup on the affected processor; watchdog timeout can escalate this to a full kernel panic, denying all system availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/handshake/netlink.c", "net/handshake/request.c", "net/handshake/tlshd.c"], "versions": [{"version": "675b453e024154dd547921c6e6d5b58747ba7e0e", "lessThan": "06ab5978866fc2221b910347fd3e510ca8e7b1a4", "status": "affected", "versionType": "git"}, {"version": "675b453e024154dd547921c6e6d5b58747ba7e0e", "lessThan": "0866569fc36a56f568acd3900d354e3505932e09", "status": "affected", "versionType": "git"}, {"version": "675b453e024154dd547921c6e6d5b58747ba7e0e", "lessThan": "91898de9501a047ba67c6b864dcd403e00bdfbf5", "status": "affected", "versionType": "git"}, {"version": "675b453e024154dd547921c6e6d5b58747ba7e0e", "lessThan": "cc993e0927ec8bd98ea33377ada03295fcda0f24", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/handshake/netlink.c", "net/handshake/request.c", "net/handshake/tlshd.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/06ab5978866fc2221b910347fd3e510ca8e7b1a4"}, {"url": "https://git.kernel.org/stable/c/0866569fc36a56f568acd3900d354e3505932e09"}, {"url": "https://git.kernel.org/stable/c/91898de9501a047ba67c6b864dcd403e00bdfbf5"}, {"url": "https://git.kernel.org/stable/c/cc993e0927ec8bd98ea33377ada03295fcda0f24"}], "title": "net/handshake: Use spin_lock_bh for hn_lock", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63980", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:34:36.706161Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:18:00.627Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63980", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:34:36.706161Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:34:37.301Z"}}], "cna": {"title": "net/handshake: Use spin_lock_bh for hn_lock", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable path is reachable through nvmet-tcp, an in-kernel network service that processes remote TCP connections; socket state-change callbacks run in softirq when remote peers disconnect during TLS handshake.\nAC:L - An attacker controls both sides of the race by opening multiple concurrent TLS connections to the NVMe/TCP target and timing abrupt disconnects against in-progress handshake submissions on the same CPU.\nPR:N - Exploitation requires only network access to an NVMe/TCP target port with TLS enabled; the TLS handshake upcall occurs before any NVMe authentication or credentials are verified.\nUI:N - No victim user action is required; the deadlock is triggered entirely by the remote attacker's connection and disconnection timing against the NVMe/TCP service.\nS:U - The deadlock affects kernel availability on the target host but does not cross a security boundary such as a VM guest-to-host escape or sandbox breakout.\nC:N - This is a spinlock deadlock with no memory corruption, out-of-bounds access, or use-after-free; no information disclosure occurs.\nI:N - The vulnerability causes a CPU hang via lock deadlock but does not modify data or enable arbitrary writes or code execution.\nA:H - A spinlock deadlock between process context and softirq causes CPU soft lockup on the affected processor; watchdog timeout can escalate this to a full kernel panic, denying all system availability."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "675b453e024154dd547921c6e6d5b58747ba7e0e", "lessThan": "06ab5978866fc2221b910347fd3e510ca8e7b1a4", "versionType": "git"}, {"status": "affected", "version": "675b453e024154dd547921c6e6d5b58747ba7e0e", "lessThan": "0866569fc36a56f568acd3900d354e3505932e09", "versionType": "git"}, {"status": "affected", "version": "675b453e024154dd547921c6e6d5b58747ba7e0e", "lessThan": "91898de9501a047ba67c6b864dcd403e00bdfbf5", "versionType": "git"}, {"status": "affected", "version": "675b453e024154dd547921c6e6d5b58747ba7e0e", "lessThan": "cc993e0927ec8bd98ea33377ada03295fcda0f24", "versionType": "git"}], "programFiles": ["net/handshake/netlink.c", "net/handshake/request.c", "net/handshake/tlshd.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.93", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.35", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.12", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/handshake/netlink.c", "net/handshake/request.c", "net/handshake/tlshd.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/06ab5978866fc2221b910347fd3e510ca8e7b1a4"}, {"url": "https://git.kernel.org/stable/c/0866569fc36a56f568acd3900d354e3505932e09"}, {"url": "https://git.kernel.org/stable/c/91898de9501a047ba67c6b864dcd403e00bdfbf5"}, {"url": "https://git.kernel.org/stable/c/cc993e0927ec8bd98ea33377ada03295fcda0f24"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: Use spin_lock_bh for hn_lock\n\nnvmet_tcp_state_change(), a socket callback that runs in BH context,\ncan reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue()\nand tls_handshake_cancel(). handshake_req_cancel() acquires\nhn->hn_lock with plain spin_lock(). If a process-context thread on\nthe same CPU holds hn->hn_lock when a softirq invokes the cancel path,\nthe lock attempt deadlocks. This is the only caller that invokes\ntls_handshake_cancel() from BH context; every other consumer calls it\nfrom process context.\n\nDeferring the cancel to process context in the NVMe target is not\nstraightforward: nvmet_tcp_schedule_release_queue() must call\ntls_handshake_cancel() atomically with its state transition to\nDISCONNECTING. If the cancel were deferred, the handshake completion\ncallback could fire in the window before the cancel runs, observe the\nunexpected state, and return without dropping its kref on the queue.\nReworking that interlock is considerably more invasive than hardening\nthe handshake lock. Convert all hn->hn_lock acquisitions from\nspin_lock/spin_unlock to spin_lock_bh/spin_unlock_bh so the lock is\nnever taken with softirqs enabled."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.93", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "6.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:37:51.364Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63980", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:18:00.627Z", "dateReserved": "2026-07-19T07:54:57.025Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T14:56:03.887Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/handshake/netlink.c", "net/handshake/request.c", "net/handshake/tlshd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "06ab5978866fc2221b910347fd3e510ca8e7b1a4", "status": "affected", "version": "675b453e024154dd547921c6e6d5b58747ba7e0e", "versionType": "git"}, {"lessThan": "0866569fc36a56f568acd3900d354e3505932e09", "status": "affected", "version": "675b453e024154dd547921c6e6d5b58747ba7e0e", "versionType": "git"}, {"lessThan": "91898de9501a047ba67c6b864dcd403e00bdfbf5", "status": "affected", "version": "675b453e024154dd547921c6e6d5b58747ba7e0e", "versionType": "git"}, {"lessThan": "cc993e0927ec8bd98ea33377ada03295fcda0f24", "status": "affected", "version": "675b453e024154dd547921c6e6d5b58747ba7e0e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/handshake/netlink.c", "net/handshake/request.c", "net/handshake/tlshd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.93", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.35", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E73413E-0629-41AA-A4D3-5A3D10A0BD63", "versionEndExcluding": "6.12.93", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382", "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: Use spin_lock_bh for hn_lock\n\nnvmet_tcp_state_change(), a socket callback that runs in BH context,\ncan reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue()\nand tls_handshake_cancel(). handshake_req_cancel() acquires\nhn->hn_lock with plain spin_lock(). If a process-context thread on\nthe same CPU holds hn->hn_lock when a softirq invokes the cancel path,\nthe lock attempt deadlocks. This is the only caller that invokes\ntls_handshake_cancel() from BH context; every other consumer calls it\nfrom process context.\n\nDeferring the cancel to process context in the NVMe target is not\nstraightforward: nvmet_tcp_schedule_release_queue() must call\ntls_handshake_cancel() atomically with its state transition to\nDISCONNECTING. If the cancel were deferred, the handshake completion\ncallback could fire in the window before the cancel runs, observe the\nunexpected state, and return without dropping its kref on the queue.\nReworking that interlock is considerably more invasive than hardening\nthe handshake lock. Convert all hn->hn_lock acquisitions from\nspin_lock/spin_unlock to spin_lock_bh/spin_unlock_bh so the lock is\nnever taken with softirqs enabled."}], "id": "CVE-2026-63980", "lastModified": "2026-11-12T18:48:26.747", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63980", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:34:36.706161Z", "version": "2.0.3"}}]}, "published": "2026-07-19T16:17:17.170", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/06ab5978866fc2221b910347fd3e510ca8e7b1a4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0866569fc36a56f568acd3900d354e3505932e09"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/91898de9501a047ba67c6b864dcd403e00bdfbf5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc993e0927ec8bd98ea33377ada03295fcda0f24"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: net/handshake: Use spin_lock_bh for hn_lock", "id": "2502354", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502354"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-833", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/handshake: Use spin_lock_bh for hn_lock\nnvmet_tcp_state_change(), a socket callback that runs in BH context,\ncan reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue()\nand tls_handshake_cancel(). handshake_req_cancel() acquires\nhn->hn_lock with plain spin_lock(). If a process-context thread on\nthe same CPU holds hn->hn_lock when a softirq invokes the cancel path,\nthe lock attempt deadlocks. This is the only caller that invokes\ntls_handshake_cancel() from BH context; every other consumer calls it\nfrom process context.\nDeferring the cancel to process context in the NVMe target is not\nstraightforward: nvmet_tcp_schedule_release_queue() must call\ntls_handshake_cancel() atomically with its state transition to\nDISCONNECTING. If the cancel were deferred, the handshake completion\ncallback could fire in the window before the cancel runs, observe the\nunexpected state, and return without dropping its kref on the queue.\nReworking that interlock is considerably more invasive than hardening\nthe handshake lock. Convert all hn->hn_lock acquisitions from\nspin_lock/spin_unlock to spin_lock_bh/spin_unlock_bh so the lock is\nnever taken with softirqs enabled.", "A flaw was found in the Linux kernel's network handshake component. An improper locking mechanism, specifically the use of `spin_lock()` instead of `spin_lock_bh()` in the `handshake_req_cancel()` function, can lead to a deadlock. This vulnerability occurs when a process-context thread holds a lock while a softirq attempts to acquire the same lock, resulting in a system freeze. This can ultimately cause a Denial of Service (DoS) condition, making the system unresponsive."], "name": "CVE-2026-63980", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63980\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63980\nhttps://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-63980-7ef7@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[675b453e024154dd547921c6e6d5b58747ba7e0e,06ab5978866fc2221b910347fd3e510ca8e7b1a4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[675b453e024154dd547921c6e6d5b58747ba7e0e,0866569fc36a56f568acd3900d354e3505932e09)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[675b453e024154dd547921c6e6d5b58747ba7e0e,91898de9501a047ba67c6b864dcd403e00bdfbf5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[675b453e024154dd547921c6e6d5b58747ba7e0e,cc993e0927ec8bd98ea33377ada03295fcda0f24)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.93,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.35,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T06:45:02.910519+00:00", "updated": "2026-10-20T09:15:12.776577+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-362", "CWE-833"]}