Cloudanix VulnDB

CVE-2026-80845

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel networking bug can make the whole system freeze when handling certain secure connections that cross network address translators.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Lock inversion between nat_keepalive_work() and xfrm_state_delete() paths causes AB-BA deadlock when the NAT keepalive worker races with SA deletion under xfrm_state_lock and per-state locks.

Why it matters to the business

Systems may experience kernel hangs or crashes during routine IPsec NAT traversal operations, disrupting network connectivity and requiring reboots with possible data loss in flight.

How an attack unfolds

An attacker triggers concurrent NAT keepalive processing and security association deletion (for example via crafted traffic and simultaneous SA teardown) to induce the deadlock and crash the kernel.

How to fix it

Apply the upstream fix that splits the keepalive walk into a lock-free collection phase followed by per-state processing; update to a kernel containing the two-phase walk change.

How to confirm the fix worked

Confirm the two-phase collection-and-reference pattern is present in net/xfrm/xfrm_state.c; test by racing NAT keepalive workers against SA deletion under lockdep.

Typical attack path

  1. Establish or manipulate IPsec SAs involving NAT keepalives
  2. Trigger xfrm_state_walk via keepalive work while holding xfrm_state_lock
  3. Concurrently invoke xfrm_state_delete which acquires locks in reverse order
  4. Cause deadlock and resulting kernel hang or panic

How to detect it

Inspect kernel logs for lockdep warnings or deadlock traces mentioning xfrm_state_lock and nat_keepalive_work; correlate with IPsec SA deletion events.

What your security team should do

  • Prioritize kernel updates for all systems using IPsec with NAT traversal
  • Monitor for kernel oops or soft lockup messages involving xfrm_state_lock
  • Restrict unprivileged access to SA management interfaces until patched

The record

In the Linux kernel, the following vulnerability has been resolved: xfrm: avoid lock inversion in nat keepalive work nat_keepalive_work() walks the state table while xfrm_state_walk() holds net->xfrm.xfrm_state_lock. Its callback then acquires x->lock, which conflicts with the delete path taking the same locks in reverse order via xfrm_state_delete() and __xfrm_state_delete(). This creates an AB-BA deadlock that is reported by lockdep when a NAT keepalive worker races with SA deletion. Fix this by splitting the keepalive walk into two phases. First, collect the candidate states while the walk holds xfrm_state_lock and take a reference on each state. Then, after the walk completes, process each collected state and acquire x->lock without nesting it under xfrm_state_lock.

Affected packages

Ecosystem Package Introduced Fixed