{"id":"CVE-2026-80845","summary":"xfrm: avoid lock inversion in nat keepalive work","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: avoid lock inversion in nat keepalive work\n\nnat_keepalive_work() walks the state table while xfrm_state_walk()\nholds net-\u003exfrm.xfrm_state_lock. Its callback then acquires x-\u003elock,\nwhich conflicts with the delete path taking the same locks in reverse\norder via xfrm_state_delete() and __xfrm_state_delete(). This creates\nan AB-BA deadlock that is reported by lockdep when a NAT keepalive\nworker races with SA deletion.\n\nFix this by splitting the keepalive walk into two phases. First,\ncollect the candidate states while the walk holds xfrm_state_lock and\ntake a reference on each state. Then, after the walk completes, process\neach collected state and acquire x-\u003elock without nesting it under\nxfrm_state_lock.","modified":"2026-09-06T03:46:53.426866888Z","published":"2026-09-04T15:54:55.489Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80845.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/5c86c895d1cac81a71ead3005084c6265cf6a7a5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/763fe700b7c58ad64fe5202c5638848244dd4127"},{"type":"WEB","url":"https://git.kernel.org/stable/c/89ef3a2e1e4682ab82b0455ce113f8c39fb9e50d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a9fa05b7a1246797748d15771052639e0d3cabf1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ea09210462316e5235a25eccb11ad0708d86615e"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80845.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80845"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae"},{"fixed":"ea09210462316e5235a25eccb11ad0708d86615e"},{"fixed":"5c86c895d1cac81a71ead3005084c6265cf6a7a5"},{"fixed":"89ef3a2e1e4682ab82b0455ce113f8c39fb9e50d"},{"fixed":"a9fa05b7a1246797748d15771052639e0d3cabf1"},{"fixed":"763fe700b7c58ad64fe5202c5638848244dd4127"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80845.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.0"},{"fixed":"6.12.108"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.49"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.13"}]},{"type":"ECOSYSTEM","events":[{"introduced":"7.2.0"},{"fixed":"7.2.3"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80845.json"}}],"schema_version":"1.9.0"}