The kernel contains a deadlock condition in the nvmet-tcp subsystem triggered when a socket in the TCP_LISTEN state is closed. During the cleanup callback the code attempts to reacquire the sk_callback_lock, which is already held, leading to a stall of the network stack. The resulting hang can prevent new connections from being accepted and may degrade or crash the kernel, effectively creating a denial‑of‑service scenario for any host relying on NVMe traffic over TCP. The flaw is a concurrency bug that corrupts the lock ordering logic of the network stack.

Any Linux kernel that has not incorporated the recent patch committing the fix to nvmet_tcp_listen_data_ready. The vulnerability resides in the core kernel code that implements NVMe‑over‑Fabrics over TCP, so it potentially affects all distributions that ship with an unpatched kernel image for that feature.

The CVSS score of 7.0 places this as a high‑severity issue. Its EPSS rate is under 1 %, indicating that, at the time of analysis, exploitation by attackers is considered unlikely, and the feature is not listed in the CISA KEV catalog. An attacker would need either local or privileged access to trigger the problematic socket closure, or have control over the NVMe over TCP interface to force the state transition. Because the bug results in a deadlock rather than a crash, remediation via an upgrade is recommended rather than attempting runtime mitigation.