CVE-2026-53197: Linux Kernel ABBA Deadlock Vulnerability

CVE-2026-53197 Overview

CVE-2026-53197 is a kernel vulnerability in the Linux xfrm IP-TFS (IP Traffic Flow Security) subsystem. The flaw is an ABBA deadlock in iptfs_destroy_state() that can hang symmetric multiprocessing (SMP) systems. The function calls hrtimer_cancel() while holding a spinlock that the timer callback itself acquires, producing a circular lock dependency.

The issue was discovered through source code audit and resolved in the upstream Linux kernel. It affects kernels that include the IPTFS xfrm mode and run on SMP hardware.

Critical Impact
Successful triggering of the deadlock freezes kernel threads on multiple CPUs, producing a denial-of-service condition on the affected host.

Affected Products

Linux kernel xfrm subsystem with IPTFS support
SMP Linux systems using IPsec IP-TFS mode
Distributions packaging vulnerable upstream kernels prior to the fix commits

Discovery Timeline

2026-06-25 - CVE-2026-53197 published to the National Vulnerability Database
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53197

Vulnerability Analysis

The vulnerability resides in iptfs_destroy_state() within the Linux kernel xfrm IPTFS implementation. The function tears down two high-resolution timers, the output timer (iptfs_timer) and the drop timer (drop_timer), while holding spinlocks that the timer callbacks also acquire.

Both timers run in HRTIMER_MODE_REL_SOFT mode, so callbacks execute in softirq context. When hrtimer_cancel() is invoked against a soft timer that is currently executing on a different CPU, it waits on softirq_expiry_lock through hrtimer_cancel_wait_running(). If that softirq is in turn blocked waiting for the spinlock already held by the canceller, a circular wait forms and both CPUs deadlock.

The race manifests as: CPU 0 holds x->lock (or drop_lock) and waits for softirq_expiry_lock, while CPU 1 holds softirq_expiry_lock inside the callback and waits for x->lock. This is a classic ABBA lock ordering bug [CWE-833].

Root Cause

The root cause is improper lock ordering between hrtimer_cancel() and the spinlocks protecting IPTFS state. The destroy path serialized timer teardown with the same lock the callback acquires, which is unnecessary because hrtimer_cancel() already guarantees the callback has finished before returning.

Attack Vector

Triggering the deadlock requires the IPTFS xfrm state to be destroyed while a timer callback is in flight on another CPU. A local actor with the ability to configure or tear down IPsec/xfrm states, or workloads that exercise IPTFS state lifecycle under load, can reach the deadlock window on SMP systems.

The vulnerability was found by source code audit. No public exploit, CISA KEV listing, or confirmed in-the-wild abuse is documented. The fix calls hrtimer_cancel() before acquiring the relevant locks, eliminating the circular dependency. For the drop timer, the lock pair is removed entirely because its only purpose was timer-callback serialization.

Detection Methods for CVE-2026-53197

Indicators of Compromise

Kernel soft lockup or hung task warnings referencing iptfs_destroy_state, iptfs_delay_timer, or iptfs_drop_timer in dmesg or /var/log/messages.
Stack traces showing CPUs blocked on softirq_expiry_lock and hrtimer_cancel_wait_running while another CPU holds x->lock or drop_lock.
Unresponsive IPsec tunnels using IPTFS mode coinciding with state teardown events.

Detection Strategies

Inventory running kernel versions across Linux fleets and compare against the fix commits 822b98d354e6, a13ca53e47e5, and c8a8a75b7334 referenced in the kernel.org git history.
Audit ip xfrm state output to identify hosts that use IPTFS mode and are therefore exposed.
Enable CONFIG_LOCKDEP and CONFIG_PROVE_LOCKING in test environments to surface ABBA dependencies during regression testing.

Monitoring Recommendations

Alert on repeated hung_task_timeout_secs warnings and RCU stall events on hosts running IPsec workloads.
Track xfrm state churn rates and correlate with kernel log anomalies to identify systems triggering the race.
Monitor IPsec tunnel availability metrics for stalls that align with state rekey or teardown windows.

How to Mitigate CVE-2026-53197

Immediate Actions Required

Update affected hosts to a Linux kernel build that includes the upstream IPTFS deadlock fix commits.
Prioritize patching SMP systems that terminate IPsec tunnels with IPTFS mode enabled.
Validate the patched kernel against IPsec workloads in a staging environment before broad rollout.

Patch Information

The fix calls hrtimer_cancel() before acquiring x->lock or drop_lock. For the output timer, the lock is reacquired afterward only to drain the packet queue. For the drop timer, the lock/unlock pair is removed entirely. The fix is available in the following commits: 822b98d354e6, a13ca53e47e5, and c8a8a75b7334. Apply the vendor-supplied kernel package that backports these commits to your distribution.

Workarounds

Disable IPTFS xfrm mode on affected hosts until the patched kernel is deployed.
Avoid frequent teardown of IPTFS xfrm states on SMP systems to reduce exposure to the race window.
Restrict local privileges that allow xfrm state manipulation to trusted administrators.

bash

# Verify the running kernel and check whether IPTFS xfrm states are configured
uname -r
ip -s xfrm state | grep -i iptfs

# After deploying the patched kernel package, reboot and confirm the new version
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r)
sudo reboot