CVE-2026-80845
Received Received - Intake

Lock Inversion in Linux Kernel XFRM NAT Keepalive

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: avoid lock inversion in nat keepalive work nat_keepalive_work() walks the state table while xfrm_state_walk() holds net->xfrm.xfrm_state_lock. Its callback then acquires x->lock, which conflicts with the delete path taking the same locks in reverse order via xfrm_state_delete() and __xfrm_state_delete(). This creates an AB-BA deadlock that is reported by lockdep when a NAT keepalive worker races with SA deletion. Fix this by splitting the keepalive walk into two phases. First, collect the candidate states while the walk holds xfrm_state_lock and take a reference on each state. Then, after the walk completes, process each collected state and acquire x->lock without nesting it under xfrm_state_lock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80845
EUVD
EUVD-2026-71295

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability involving a deadlock in the xfrm (IPsec) subsystem. A NAT keepalive worker thread and SA (Security Association) deletion path can deadlock when they acquire locks in opposite orders. The keepalive thread holds xfrm_state_lock while walking the state table, then tries to acquire x->lock, while the delete path does the reverse.

Detection Guidance

This vulnerability is specific to the Linux kernel's xfrm implementation and may not have direct detection commands. However, you can check for lockdep warnings in kernel logs which indicate deadlock issues. Use 'dmesg | grep -i lockdep' to search for lock inversion warnings. Also, monitor for system hangs or crashes during NAT keepalive operations.

Impact Analysis

This could cause system hangs or crashes if the deadlock occurs. Systems using IPsec with NAT keepalives may become unresponsive until rebooted. It primarily affects network security operations but does not directly expose data.

Mitigation Strategies

Apply the latest kernel security patches that include the fix for this issue. If patching is not immediately possible, consider disabling NAT keepalive functionality if it is not critical to your operations. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80845. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart