{"id":"CVE-2026-80845","title":"xfrm: avoid lock inversion in nat keepalive work","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: avoid lock inversion in nat keepalive work\n\nnat_keepalive_work() walks the state table while xfrm_state_walk()\nholds net->xfrm.xfrm_state_lock. Its callback then …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae < ea09210462316e5235a25eccb11ad0708d86615e","Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae < 5c86c895d1cac81a71ead3005084c6265cf6a7a5","Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae < 89ef3a2e1e4682ab82b0455ce113f8c39fb9e50d","Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae < a9fa05b7a1246797748d15771052639e0d3cabf1","Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae < 763fe700b7c58ad64fe5202c5638848244dd4127","Linux 6.11"],"published":"2026-09-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:44:39.455Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80845","references":[{"url":"https://git.kernel.org/stable/c/ea09210462316e5235a25eccb11ad0708d86615e"},{"url":"https://git.kernel.org/stable/c/5c86c895d1cac81a71ead3005084c6265cf6a7a5"},{"url":"https://git.kernel.org/stable/c/89ef3a2e1e4682ab82b0455ce113f8c39fb9e50d"},{"url":"https://git.kernel.org/stable/c/a9fa05b7a1246797748d15771052639e0d3cabf1"},{"url":"https://git.kernel.org/stable/c/763fe700b7c58ad64fe5202c5638848244dd4127"}],"tags":["cve.org"],"epss":0.00168,"epssPercentile":0.05663,"ingestedAt":"2026-10-19T09:16:01.497Z","slug":"CVE-2026-80845","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: avoid lock inversion in nat keepalive work\n\nnat_keepalive_work() walks the state table while xfrm_state_walk()\nholds net->xfrm.xfrm_state_lock. Its callback then acquires x->lock,\nwhich conflicts with the delete path taking the same locks in reverse\norder via xfrm_state_delete() and __xfrm_state_delete(). This creates\nan AB-BA deadlock that is reported by lockdep when a NAT keepalive\nworker races with SA deletion.\n\nFix this by splitting the keepalive walk into two phases. First,\ncollect the candidate states while the walk holds xfrm_state_lock and\ntake a reference on each state. Then, after the walk completes, process\neach collected state and acquire x->lock without nesting it under\nxfrm_state_lock.\n\n## Affected\n\n- `Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae < ea09210462316e5235a25eccb11ad0708d86615e`\n- `Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae < 5c86c895d1cac81a71ead3005084c6265cf6a7a5`\n- `Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae < 89ef3a2e1e4682ab82b0455ce113f8c39fb9e50d`\n- `Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae < a9fa05b7a1246797748d15771052639e0d3cabf1`\n- `Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae < 763fe700b7c58ad64fe5202c5638848244dd4127`\n- `Linux 6.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}