The flaw lies in the Linux kernel's NVMe target subsystem where a spin lock protecting handshake state (hn_lock) is acquired with spin_lock() while a soft interrupt (softirq) may also attempt to acquire the same lock, leading to a deadlock (CWE‑833). When a process‑context thread holds hn->hn_lock and a BH context invocation of handshake cancellation runs, the lock attempt blocks indefinitely, stopping the kernel thread responsible for the NVMe connection. This results in a denial of service because the kernel becomes unresponsive to further requests and overall system stability is compromised.

All Linux kernel builds that include the nvmet_tcp driver and the handshake module may be affected until the lock is converted to spin_lock_bh as described in commit 06ab5978866fc2221b910347fd3e510ca8e7b1a4. Administrators should confirm whether their deployed kernel version contains this change, as the advisory does not list specific version ranges.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% signals a low probability of active exploitation. The vulnerability is not included in CISA's KEV catalog. Based on the description, it is inferred that an attacker could trigger the cancellation path by sending crafted NVMe over TCP traffic to a host exposing the service, providing a remote avenue for exploitation. Consequently, systems that expose NVMe target services without adequate protection are at high risk pending remediation.