CVE-2026-80845

A flaw was found in the Linux kernel's xfrm (IPSec framework) component. A lock inversion vulnerability exists within the nat_keepalive_work() function. This flaw can lead to an AB-BA deadlock when a Network Address Translation (NAT) keepalive worker races with Security Association (SA) deletion. The deadlock can cause the system to become unresponsive, resulting in a Denial of Service (DoS).

This vulnerability is evaluated as having a Low impact for Red Hat Enterprise Linux because triggering the lock inversion requires an active IPsec configuration utilizing NAT keepalive alongside concurrent security association removal. In standard environments, managing IPsec states requires elevated network administrative privileges, significantly constraining potential attack vectors. Consequently, unprivileged users cannot easily induce this deadlock to cause a system denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.