CVE-2026-80845

In the Linux kernel, the following vulnerability has been resolved:

xfrm: avoid lock inversion in nat keepalive work

nat keepalive work() walks the state table while xfrm state walk() holds net->xfrm.xfrm state lock. Its callback then acquires x->lock, which conflicts with the delete path taking the same locks in reverse order via xfrm state delete() and xfrm state delete(). This creates an AB-BA deadlock that is reported by lockdep when a NAT keepalive worker races with SA deletion.

Fix this by splitting the keepalive walk into two phases. First, collect the candidate states while the walk holds xfrm state lock and take a reference on each state. Then, after the walk completes, process each collected state and acquire x->lock without nesting it under xfrm state lock.