CVE-2026-53197

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()<br /> <br /> iptfs_destroy_state() calls hrtimer_cancel() while holding a spinlock<br /> that the timer callback also acquires, leading to an ABBA deadlock on<br /> SMP systems.<br /> <br /> For the output timer (iptfs_timer):<br /> - iptfs_destroy_state() holds x-&gt;lock, calls hrtimer_cancel()<br /> - iptfs_delay_timer() callback takes x-&gt;lock<br /> <br /> For the drop timer (drop_timer):<br /> - iptfs_destroy_state() holds drop_lock, calls hrtimer_cancel()<br /> - iptfs_drop_timer() callback takes drop_lock<br /> <br /> Both timers use HRTIMER_MODE_REL_SOFT, so their callbacks run in softirq<br /> context. When hrtimer_cancel() is called for a soft timer that is<br /> currently executing on another CPU, hrtimer_cancel_wait_running() spins<br /> on softirq_expiry_lock -- the same lock held by the softirq running the<br /> callback. If the callback is blocked waiting for the spinlock held by<br /> the caller of hrtimer_cancel(), a circular dependency forms:<br /> <br /> CPU 0: holds lock_A -&gt; waits for softirq_expiry_lock<br /> CPU 1: holds softirq_expiry_lock -&gt; waits for lock_A<br /> <br /> Fix by calling hrtimer_cancel() before acquiring the respective locks.<br /> hrtimer_cancel() is safe to call without holding any lock and will wait<br /> for any in-progress callback to complete. For the output timer, the<br /> lock is still acquired afterwards to drain the packet queue. For the<br /> drop timer, the lock/unlock pair is removed entirely since it only<br /> existed to serialize with the timer callback, which hrtimer_cancel()<br /> already guarantees.<br /> <br /> Found by source code audit.