CVE-2026-53197

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()

iptfs_destroy_state() calls hrtimer_cancel() while holding a spinlock

that the timer callback also acquires, leading to an ABBA deadlock on

SMP systems.

For the output timer (iptfs_timer):

- iptfs_destroy_state() holds x->lock, calls hrtimer_cancel()

- iptfs_delay_timer() callback takes x->lock

For the drop timer (drop_timer):

- iptfs_destroy_state() holds drop_lock, calls hrtimer_cancel()

- iptfs_drop_timer() callback takes drop_lock

Both timers use HRTIMER_MODE_REL_SOFT, so their callbacks run in softirq

context. When hrtimer_cancel() is called for a soft timer that is

currently executing on another CPU, hrtimer_cancel_wait_running() spins

on softirq_expiry_lock -- the same lock held by the softirq running the

callback. If the callback is blocked waiting for the spinlock held by

the caller of hrtimer_cancel(), a circular dependency forms:

CPU 0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References