---
id: CVE-2026-80845
title: 'xfrm: avoid lock inversion in nat keepalive work'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfrm: avoid lock inversion in nat keepalive work

  nat_keepalive_work() walks the state table while xfrm_state_walk()
  holds net->xfrm.xfrm_state_lock. Its callback then …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae <
    ea09210462316e5235a25eccb11ad0708d86615e
  - >-
    Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae <
    5c86c895d1cac81a71ead3005084c6265cf6a7a5
  - >-
    Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae <
    89ef3a2e1e4682ab82b0455ce113f8c39fb9e50d
  - >-
    Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae <
    a9fa05b7a1246797748d15771052639e0d3cabf1
  - >-
    Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae <
    763fe700b7c58ad64fe5202c5638848244dd4127
  - Linux 6.11
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:44:39.455Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80845'
references:
  - url: 'https://git.kernel.org/stable/c/ea09210462316e5235a25eccb11ad0708d86615e'
  - url: 'https://git.kernel.org/stable/c/5c86c895d1cac81a71ead3005084c6265cf6a7a5'
  - url: 'https://git.kernel.org/stable/c/89ef3a2e1e4682ab82b0455ce113f8c39fb9e50d'
  - url: 'https://git.kernel.org/stable/c/a9fa05b7a1246797748d15771052639e0d3cabf1'
  - url: 'https://git.kernel.org/stable/c/763fe700b7c58ad64fe5202c5638848244dd4127'
tags:
  - cve.org
epss: 0.00168
epssPercentile: 0.05663
ingestedAt: '2026-10-19T09:16:01.497Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfrm: avoid lock inversion in nat keepalive work

nat_keepalive_work() walks the state table while xfrm_state_walk()
holds net->xfrm.xfrm_state_lock. Its callback then acquires x->lock,
which conflicts with the delete path taking the same locks in reverse
order via xfrm_state_delete() and __xfrm_state_delete(). This creates
an AB-BA deadlock that is reported by lockdep when a NAT keepalive
worker races with SA deletion.

Fix this by splitting the keepalive walk into two phases. First,
collect the candidate states while the walk holds xfrm_state_lock and
take a reference on each state. Then, after the walk completes, process
each collected state and acquire x->lock without nesting it under
xfrm_state_lock.

## Affected

- `Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae < ea09210462316e5235a25eccb11ad0708d86615e`
- `Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae < 5c86c895d1cac81a71ead3005084c6265cf6a7a5`
- `Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae < 89ef3a2e1e4682ab82b0455ce113f8c39fb9e50d`
- `Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae < a9fa05b7a1246797748d15771052639e0d3cabf1`
- `Linux >= f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae < 763fe700b7c58ad64fe5202c5638848244dd4127`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.