xfrm: avoid lock inversion in nat keepalive work (CVE-2026-80845) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-80845

xfrm: avoid lock inversion in nat keepalive work

Answer in brief

CVE-2026-80845 records a Unknown severity vulnerability in xfrm: avoid lock inversion in nat keepalive work. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 4, 2026Updated Sep 4, 2026Source checked Sep 4, 2026First seen by HOL Sep 4, 2026Material review Sep 4, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae <ea09210462316e5235a25eccb11ad0708d86615e \|\| >=f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae <5c86c895d1cac81a71ead3005084c6265cf6a7a5 \|\| >=f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae <89ef3a2e1e4682ab82b0455ce113f8c39fb9e50d \|\| >=f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae <a9fa05b7a1246797748d15771052639e0d3cabf1 \|\| >=f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae <763fe700b7c58ad64fe5202c5638848244dd4127	ea09210462316e5235a25eccb11ad0708d86615e, 5c86c895d1cac81a71ead3005084c6265cf6a7a5, 89ef3a2e1e4682ab82b0455ce113f8c39fb9e50d, a9fa05b7a1246797748d15771052639e0d3cabf1, 763fe700b7c58ad64fe5202c5638848244dd4127
Linux/Linuxgeneric	6.11	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to ea09210462316e5235a25eccb11ad0708d86615e if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 4, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: xfrm: avoid lock inversion in nat keepalive work nat_keepalive_work() walks the state table while xfrm_state_walk() holds net->xfrm.xfrm_state_lock. Its callback then acquires x->lock, which conflicts with the delete path taking the same locks in reverse order via xfrm_state_delete() and __xfrm_state_delete(). This creates an AB-BA deadlock that is reported by lockdep when a NAT keepalive worker races with SA deletion. Fix this by splitting the keepalive walk into two phases. First, collect the candidate states while the walk holds xfrm_state_lock and take a reference on each state. Then, after the walk completes, process each collected state and acquire x->lock without nesting it under xfrm_state_lock.

Quoted source text, attributed separately from HOL analysis.