CVE-2026-53197: Linux Kernel IPTFS Deadlock Vulnerability (CVSS 5.5)

Technical summary

CVE-2026-53197 is an ABBA deadlock in the Linux kernel's xfrm IPTFS module, specifically in the iptfs_destroy_state() function. The vulnerability involves two timer cancellation paths: (1) iptfs_timer (output timer) where iptfs_destroy_state() holds x->lock before calling hrtimer_cancel(), but the iptfs_delay_timer() callback also requires x->lock; and (2) drop_timer where iptfs_destroy_state() holds drop_lock before calling hrtimer_cancel(), but iptfs_drop_timer() callback also requires drop_lock. Both timers are configured with HRTIMER_MODE_REL_SOFT, causing callbacks to execute in softirq context. When hrtimer_cancel() is invoked on a soft timer executing on another CPU, it spins on softirq_expiry_lock—the same lock held by the softirq context running the callback. If the callback is blocked waiting for the spinlock held by the hrtimer_cancel() caller, a circular dependency forms: CPU 0 holds lock_A while waiting for softirq_expiry_lock, and CPU 1 holds softirq_expiry_lock while waiting for lock_A. The fix relocates hrtimer_cancel() calls to occur before acquiring the respective spinlocks, eliminating the circular wait.

Business impact

This vulnerability can cause kernel hangs and system unavailability on multi-processor systems running IPTFS-enabled configurations. IPTFS is used in IPsec deployments for traffic flow security, common in VPN gateways, secure border routers, and high-security network appliances. A deadlock in the state destruction path means that terminating IPsec connections or unloading the IPTFS module can freeze the system rather than gracefully shutting down. Organizations relying on IPsec-based security perimeters may experience unexpected service interruptions, particularly during routine maintenance or failover scenarios.

Affected systems

The vulnerability affects all Linux kernel versions with IPTFS support in the xfrm subsystem. IPTFS was introduced in the kernel to provide confidentiality for IPsec traffic patterns. Systems running Linux kernels with IPTFS compiled in or as a module, particularly on multi-core/multi-processor architectures, are susceptible. This includes enterprise routers, cloud infrastructure components, VPN appliances, and any Linux systems with active IPsec connections using IPTFS. Single-processor systems may exhibit the deadlock under extreme contention but are less likely to trigger the race condition reliably.

Exploitability

Exploitability requires local privilege escalable to create and destroy IPTFS state objects, typically necessitating CAP_NET_ADMIN capabilities or direct kernel module manipulation. No remote attack vector exists. The vulnerability manifests as a denial of service through system hang rather than privilege escalation or data compromise. Triggering requires specific IPsec configuration and intentional state destruction; casual system operation is unlikely to encounter this condition. However, legitimate administrative operations—such as reconfiguring IPsec policies, gracefully stopping VPN services, or unloading kernel modules—will reliably trigger the deadlock on affected systems.

Remediation

The fix involves refactoring iptfs_destroy_state() to call hrtimer_cancel() before acquiring spinlocks rather than within the critical section. For the output timer, the spinlock is re-acquired afterward to safely drain queued packets. For the drop timer, the spinlock/unlock pair is removed entirely since hrtimer_cancel() already serializes against callback completion. This eliminates the circular lock dependency while preserving the synchronization guarantees needed for safe resource cleanup. Kernel distributions and system administrators should apply this patch as part of their regular kernel update cycle.

Patch guidance

Patch this vulnerability by updating to a Linux kernel version incorporating the IPTFS deadlock fix. Check your distribution's kernel advisory for the specific version number addressing CVE-2026-53197. For RHEL/CentOS systems, Fedora, Ubuntu, and Debian users: consult your vendor's security bulletin for the patched kernel version. For custom or internally maintained kernels: apply the upstream fix from the Linux kernel repository, which reorders hrtimer_cancel() calls to precede spinlock acquisition in iptfs_destroy_state(). Verify the patch against the vendor advisory to confirm the exact kernel version and module configuration affected in your environment.

Detection guidance

Monitor system logs for kernel warnings or softlockup/hardlockup messages coinciding with IPsec state teardown or VPN connection termination. Kernel debug output may show warnings about suspicious spinlock contention or scheduler latency spikes. On affected systems, capture kernel traces during IPsec policy changes or service restart cycles using tools like ftrace or perf to identify lock contention patterns. Check dmesg for 'NMI watchdog' or 'BUG: soft lockup' messages. Test patch deployment in non-production IPTFS-enabled environments by intentionally restarting IPsec services and monitoring for hang conditions. Use sysstat tools to detect periods of 100% CPU utilization with no actual work progress, which may indicate kernel spinlock contention.

Why prioritize this

Assign this a medium-to-high priority in patching queues for systems actively using IPTFS, lower priority for generic Linux deployments where IPTFS is not explicitly enabled. The CVSS score of 5.5 reflects local privilege requirement and denial-of-service impact without data breach. However, the practical severity is elevated for organizations dependent on continuous IPsec availability—particularly cloud providers, ISPs, and security-focused enterprises where VPN service interruptions directly impact business continuity. Prioritize patching for production IPsec gateways and VPN concentrators; standard desktop/server systems without IPsec configuration can defer patching to the next regular maintenance window.

Risk score, explained

The CVSS v3.1 score of 5.5 (MEDIUM severity) reflects: Attack Vector Local (AV:L) requiring direct system access; Attack Complexity Low (AC:L) as the trigger is straightforward IPsec state destruction; Privileges Required Low (PR:L) as CAP_NET_ADMIN is needed; User Interaction None (UI:N); Scope Unchanged (S:U); Confidentiality None (C:N); Integrity None (I:N); Availability High (A:H) due to system hang. The score appropriately captures that this is not a remote vulnerability and causes denial of service rather than data compromise, yet the impact on system availability is severe for affected deployments.

Frequently asked questions