CVE-2026-53197

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An ABBA deadlock occurs in the xfrm iptfs component within the iptfs destroy state() function on SMP systems. The issue arises when iptfs destroy state() calls hrtimer cancel() while holding a spinlock that the timer callback also attempts to acquire. Specifically, for the output timer (iptfs timer), the function holds x->lock while calling hrtimer cancel(), while the iptfs delay timer() callback requires x->lock. Similarly, for the drop timer (drop timer), the function holds drop lock while calling hrtimer cancel(), while the iptfs drop timer() callback requires drop lock.

Because these timers use HRTIMER MODE REL SOFT, callbacks execute in softirq context. If hrtimer cancel() is called for a timer executing on another CPU, it waits for the softirq expiry lock. If the callback is simultaneously waiting for the spinlock held by the caller, a circular dependency is created between the two CPUs, resulting in a system deadlock.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.