CVE-2026-23179: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23179 is a deadlock vulnerability in the Linux kernel's NVMe-over-TCP (nvmet-tcp) subsystem, specifically in the nvmet_tcp_listen_data_ready() function. The flaw occurs when a socket is closed while in the TCP_LISTEN state, triggering a callback that flushes outstanding packets and calls nvmet_tcp_listen_data_ready() with the sk_callback_lock already held — causing a deadlock if the function then attempts to re-acquire the same lock. It affects the Linux kernel across multiple stable branches and distributions. The CVSS category is estimated as Medium, with an EPSS score of 0.000180 (Feedly).

The root cause is a locking order violation / deadlock condition (CWE-667: Improper Locking) in the nvmet_tcp_listen_data_ready() callback within the Linux kernel's nvmet-tcp driver. When a TCP listening socket is closed, the kernel invokes a flush callback with sk_callback_lock held; if nvmet_tcp_listen_data_ready() is called in this context and attempts to acquire sk_callback_lock again, a deadlock results. The fix requires checking whether the socket is in TCP_LISTEN state before attempting to acquire sk_callback_lock, thereby avoiding the recursive lock acquisition. Patches were committed to multiple stable kernel trees (Kernel Git, Kernel Git, Kernel Git).

Successful triggering of this vulnerability causes a kernel deadlock in the NVMe-over-TCP subsystem, resulting in a system hang or denial of service on affected hosts. The availability impact is the primary concern, as the deadlock can render the NVMe-TCP target unresponsive, disrupting storage access for connected clients. There is no known confidentiality or integrity impact, and the vulnerability does not enable remote code execution or privilege escalation (Feedly).

Apply the upstream Linux kernel patches that add a TCP_LISTEN state check in nvmet_tcp_listen_data_ready() before acquiring sk_callback_lock. Fixes have been committed to multiple stable kernel branches and are available via the kernel stable tree (Kernel Git). Downstream distributions including Debian, Ubuntu, Oracle Linux, and Red Hat have issued updated kernel packages; administrators should apply the latest kernel updates from their respective vendors. As a temporary workaround where patching is not immediately possible, disabling the nvmet-tcp kernel module (if NVMe-over-TCP target functionality is not required) will eliminate exposure.

Coverage has been limited to routine Linux security advisory tracking by distributions such as Debian, Ubuntu, Oracle Linux, and Red Hat, as well as scanner detections by Nessus and Qualys. German Linux security outlet pro-linux.de published multiple update advisories referencing this CVE. No notable researcher commentary or broader media coverage has been identified (Feedly).