Executive brief
The Linux kernel's IPsec implementation contains a deadlock vulnerability in the NAT keepalive worker thread. When the keepalive process runs simultaneously with IPsec Security Association (SA) deletion, it can cause the system to hang. This results in service unavailability and potential system instability, particularly in networked systems relying on IPsec for security.
Technical details
The vulnerability is a lock inversion (AB-BA deadlock) in the xfrm subsystem's nat_keepalive_work() function. The keepalive worker holds net->xfrm.xfrm_state_lock while its callback attempts to acquire x->lock, but the SA deletion path takes these locks in reverse order (x->lock then xfrm_state_lock) via xfrm_state_delete() and __xfrm_state_delete(). This creates a classic deadlock when both code paths race. The fix restructures the keepalive walk into two phases: first collecting candidate states under xfrm_state_lock with reference counting, then processing them after releasing the lock. This is a logic error in lock ordering, not a memory corruption or authentication bypass, affecting systems running the Linux kernel with IPsec enabled.
Affected products
- Linux Linux kernel Multiple versions (patch applied to stable branches from linux-4.14.y through linux-7.2.y and rolling branches)
Timeline
- 2026-09-04: disclosed: CVE-2026-80845 published on NVD
- 2026-07-21: patched: Fix committed upstream (commit 763fe700b7c58ad64fe5202c5638848244dd4127)
- 2026-09-02: patched: Fix backported to stable kernel series (commit 5c86c895d1cac81a71ead3005084c6265cf6a7a5)