Executive brief
A flaw in the Linux kernel's IP Traffic Flow Security (IPTFS) component can cause a system deadlock, leading to a complete system freeze or crash. This occurs during specific network state cleanup operations on multi-processor systems. While it does not directly expose data, it can be used to disrupt service availability and cause operational downtime.
Technical details
An ABBA deadlock exists in net/xfrm/xfrm_iptfs.c within the iptfs_destroy_state() function. The vulnerability is caused by calling hrtimer_cancel() while holding a spinlock (x->lock or drop_lock) that the timer's own callback also attempts to acquire. On SMP systems, if the timer callback is executing on another CPU in softirq context, hrtimer_cancel() will wait for the callback to finish while the callback waits for the spinlock held by the caller, resulting in a circular dependency. This affects systems using the IPTFS xfrm mode. The fix involves reordering the calls to ensure hrtimer_cancel() is invoked before the spinlocks are acquired.
Affected products
- Linux Linux Kernel 6.14 to 7.1
Timeline
- 2026-06-02: other: Vulnerability identified and patch authored
- 2026-06-25: disclosed: CVE-2026-53197 published