CVE-2026-80845 xfrm: avoid lock inversion in nat keepalive work
A race condition in the Linux kernel's xfrm NAT keepalive worker can cause a deadlock, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80845?
CVE-2026-80845 is a vulnerability in Linux, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfrm: avoid lock inversion in nat keepalive work
nat_keepalive_work() walks the state table while xfrm_state_walk() holds net->xfrm.xfrm_state_lock. Its callback then acquires x->lock, which conflicts with the delete path taking the same locks in reverse order via xfrm_state_delete() and __xfrm_state_delete(). This creates an AB-BA deadlock that is reported by lockdep when a NAT keepalive worker races with SA deletion.
Fix this by splitting the keepalive walk into two phases. First, collect the candidate states while the walk holds xfrm_state_lock and take a reference on each state. Then, after the walk completes, process each collected state and acquire x->lock without nesting it under xfrm_state_lock.
Which versions are affected by CVE-2026-80845?
How do I fix CVE-2026-80845?
Apply the vendor's patch.
Is CVE-2026-80845 being exploited?
There is no known exploitation of CVE-2026-80845 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80845, DEBIAN-CVE-2026-80845, GHSA-cpc7-qx2r-p3m3, UBUNTU-CVE-2026-80845.