« Volver al listado

CVE-2026-63980

Estado: Pendiente de análisisAlta (7.5)—

In the Linux kernel, the following vulnerability has been resolved:

net/handshake: Use spin_lock_bh for hn_lock

nvmet_tcp_state_change(), a socket callback that runs in BH context, can reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue() and tls_handshake_cancel(). handshake_req_cancel() acquires hn->hn_lock with plain spin_lock(). If a process-context thread on the same CPU holds hn->hn_lock when a softirq invokes the cancel path, the lock attempt deadlocks. This is the only caller that invokes tls_handshake_cancel() from BH context; every other consumer calls it from process context.

Leer descripción completaMostrar menos

Deferring the cancel to process context in the NVMe target is not straightforward: nvmet_tcp_schedule_release_queue() must call tls_handshake_cancel() atomically with its state transition to DISCONNECTING. If the cancel were deferred, the handshake completion callback could fire in the window before the cancel runs, observe the unexpected state, and return without dropping its kref on the queue. Reworking that interlock is considerably more invasive than hardening the handshake lock. Convert all hn->hn_lock acquisitions from spin_lock/spin_unlock to spin_lock_bh/spin_unlock_bh so the lock is never taken with softirqs enabled.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-63980",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "lessThan": "06ab5978866fc2221b910347fd3e510ca8e7b1a4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "lessThan": "0866569fc36a56f568acd3900d354e3505932e09",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "lessThan": "91898de9501a047ba67c6b864dcd403e00bdfbf5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "lessThan": "cc993e0927ec8bd98ea33377ada03295fcda0f24",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/handshake/netlink.c",
            "net/handshake/request.c",
            "net/handshake/tlshd.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.7",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.*"
            },
            {
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/handshake/netlink.c",
            "net/handshake/request.c",
            "net/handshake/tlshd.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-19T16:17:17.170",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/06ab5978866fc2221b910347fd3e510ca8e7b1a4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/0866569fc36a56f568acd3900d354e3505932e09",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/91898de9501a047ba67c6b864dcd403e00bdfbf5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cc993e0927ec8bd98ea33377ada03295fcda0f24",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: Use spin_lock_bh for hn_lock\n\nnvmet_tcp_state_change(), a socket callback that runs in BH context,\ncan reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue()\nand tls_handshake_cancel().  handshake_req_cancel() acquires\nhn->hn_lock with plain spin_lock().  If a process-context thread on\nthe same CPU holds hn->hn_lock when a softirq invokes the cancel path,\nthe lock attempt deadlocks.  This is the only caller that invokes\ntls_handshake_cancel() from BH context; every other consumer calls it\nfrom process context.\n\nDeferring the cancel to process context in the NVMe target is not\nstraightforward: nvmet_tcp_schedule_release_queue() must call\ntls_handshake_cancel() atomically with its state transition to\nDISCONNECTING.  If the cancel were deferred, the handshake completion\ncallback could fire in the window before the cancel runs, observe the\nunexpected state, and return without dropping its kref on the queue.\nReworking that interlock is considerably more invasive than hardening\nthe handshake lock.  Convert all hn->hn_lock acquisitions from\nspin_lock/spin_unlock to spin_lock_bh/spin_unlock_bh so the lock is\nnever taken with softirqs enabled."
    }
  ],
  "lastModified": "2026-07-30T14:51:11.223",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}