CVE-2026-80845 Overview
CVE-2026-80845 is a Linux kernel vulnerability in the xfrm (IP transformation framework) subsystem. The flaw resides in nat_keepalive_work(), which walks the state table while xfrm_state_walk() holds net->xfrm.xfrm_state_lock. The callback then acquires x->lock, conflicting with the delete path that takes the same locks in reverse order via xfrm_state_delete() and __xfrm_state_delete(). This creates an AB-BA lock inversion that lockdep flags when a NAT keepalive worker races with Security Association (SA) deletion.
Critical Impact
The lock inversion can produce a deadlock between NAT keepalive processing and SA deletion, stalling IPsec state management and degrading kernel networking availability.
Affected Products
- Linux kernel xfrm subsystem (NAT keepalive work path)
- Distributions shipping affected stable kernel branches prior to the referenced fix commits
- IPsec deployments using NAT traversal (NAT-T) keepalives
Discovery Timeline
- 2026-09-04 - CVE-2026-80845 published to the National Vulnerability Database
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80845
Vulnerability Analysis
The defect is a classic AB-BA lock inversion in the kernel IPsec code. The NAT keepalive worker acquires net->xfrm.xfrm_state_lock first through xfrm_state_walk(), then acquires the per-state x->lock inside its callback. The state deletion path takes the same locks in the opposite order via xfrm_state_delete() and __xfrm_state_delete(). When both paths execute concurrently on different CPUs, each can hold one lock while waiting for the other. Lockdep reports the inversion as a potential deadlock. This is a race condition and deadlock class defect rather than a memory-safety flaw.
Root Cause
The root cause is inconsistent lock ordering between the keepalive walk callback and the SA teardown path. The keepalive work performs mutating operations under a table-wide read while later grabbing a per-object mutex, violating the ordering required by the deletion path.
Attack Vector
The issue is triggered by legitimate concurrent activity: a NAT keepalive worker running while an administrator or protocol event deletes an SA. Any workload combining IPsec with NAT traversal can encounter the race. No specific attacker interaction has been disclosed, and no exploit is public. The vulnerability manifests as a hang or lockdep splat in kernel logs. See the upstream fix at Kernel Git Commit 5c86c89 for the exact patch.
No verified proof-of-concept code is available for this issue. The fix splits the keepalive walk into two phases: first collect candidate states while holding xfrm_state_lock and take a reference on each, then process each state and acquire x->lock outside the outer lock.
Detection Methods for CVE-2026-80845
Indicators of Compromise
- Lockdep warnings referencing nat_keepalive_work, xfrm_state_walk, xfrm_state_delete, or __xfrm_state_delete in dmesg or journalctl -k output.
- Kernel soft-lockup or hung task messages on hosts running IPsec with NAT-T keepalives.
- Stalled IKE daemons (strongSwan, Libreswan) unable to complete SA rekey or teardown.
Detection Strategies
- Enable CONFIG_PROVE_LOCKING on test kernels to surface the AB-BA report during QA.
- Monitor kernel logs for stack traces containing both xfrm_state_lock and per-state x->lock acquisition sites.
- Track kernel package versions across the fleet and flag hosts running IPsec workloads on unpatched branches.
Monitoring Recommendations
- Forward kernel logs to a central log platform and alert on BUG: or WARNING: entries in xfrm code paths.
- Instrument IPsec tunnel health checks to detect keepalive stalls and SA churn anomalies.
- Track uptime versus expected patch level to identify hosts that have not rebooted into a fixed kernel.
How to Mitigate CVE-2026-80845
Immediate Actions Required
- Identify Linux hosts running IPsec with NAT traversal enabled and inventory their kernel versions.
- Schedule updates to a stable kernel release that includes the fix commits listed in the references.
- Reboot patched systems to load the corrected xfrm module code.
Patch Information
The upstream fix restructures nat_keepalive_work() into a two-phase walk. Applicable stable-tree commits include Kernel Git Commit 5c86c89, Kernel Git Commit 763fe70, Kernel Git Commit 89ef3a2, Kernel Git Commit a9fa05b, and Kernel Git Commit ea09210. Apply the vendor kernel update from your distribution that references these commits.
Workarounds
- Where operationally acceptable, disable NAT-T keepalives on affected tunnels to remove the contending code path until a patched kernel is deployed.
- Reduce SA churn by extending rekey intervals in the IKE daemon configuration to lower the probability of the race window.
- Restrict administrative operations that mass-delete SAs during peak keepalive activity on unpatched hosts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
