CVE-2026-23179
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() When the socket is closed while in TCP_LISTEN a callback is run to flush all outstanding packets, which in turns calls nvmet_tcp_listen_data_ready() with the sk_callback_lock held. So we need to check if we are in TCP_LISTEN before attempting to get the sk_callback_lock() to avoid a deadlock.
Affected versions
Linux kernel versions
6.7
and later are affected. Fixed in
6.12.70,
6.18.10,
6.19
and their respective stable series.
References
The following references provide additional information about CVE-2026-23179 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/1c90f930e7b410dd2d75a2a19a85e19c64e98ad5
-
PatchKernel patch commithttps://git.kernel.org/stable/c/2fa8961d3a6a1c2395d8d560ffed2c782681bade
-
PatchKernel patch commithttps://git.kernel.org/stable/c/6e0c7503a5803d568d56a9f9bca662cd94a14908
Frequently asked questions
-
What is CVE-2026-23179?
CVE-2026-23179 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.7 onward and has been patched in 6.12.70, 6.18.10 and 6.19. CVE-2026-23179 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-23179?
Yes — CVE-2026-23179 has been patched. Fixed versions include 6.12.70, 6.18.10 and 6.19. If you are running Linux kernel 6.7 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-23179 actively exploited?
No — CVE-2026-23179 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.