CVE-2026-80845xfrm: avoid lock inversion in nat keepalive work
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xfrm: avoid lock inversion in nat keepalive work nat_keepalive_work() walks the state table while xfrm_state_walk() holds net->xfrm.xfrm_state_lock. Its callback then acquires x->lock, which conflicts with the delete path taking the same locks in reverse order via xfrm_state_delete() and __xfrm_state_delete(). This creates an AB-BA deadlock that is reported by lockdep when a NAT keepalive worker races with SA deletion. Fix this by splitting the keepalive walk into two phases. First, collect the candidate states while the walk holds xfrm_state_lock and take a reference on each state. Then, after the walk completes, process each collected state and acquire x->lock without nesting it under xfrm_state_lock.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae before ea09210462316e5235a25eccb11ad0708d86615e; from f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae before 5c86c895d1cac81a71ead3005084c6265cf6a7a5; from f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae before 89ef3a2e1e4682ab82b0455ce113f8c39fb9e50d; from f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae before a9fa05b7a1246797748d15771052639e0d3cabf1; from f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae before 763fe700b7c58ad64fe5202c5638848244dd4127 | CNA record |
References
- https://git.kernel.org/stable/c/ea09210462316e5235a25eccb11ad0708d86615e
- https://git.kernel.org/stable/c/5c86c895d1cac81a71ead3005084c6265cf6a7a5
- https://git.kernel.org/stable/c/89ef3a2e1e4682ab82b0455ce113f8c39fb9e50d
- https://git.kernel.org/stable/c/a9fa05b7a1246797748d15771052639e0d3cabf1
- https://git.kernel.org/stable/c/763fe700b7c58ad64fe5202c5638848244dd4127
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.