# CVE-2026-53197: linux: In the Linux kernel, the following vulnerability has been resolved:  xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_...

CVE-2026-53197 is fixed in linux on 1 platform by DEBIAN-CVE-2026-53197 (version 7.0.13-1), released June 28, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-53197
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0012
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 25, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()  iptfs_destroy_state() calls hrtimer_cancel() while holding a spinlock that the timer callback also acquires, leading to an ABBA deadlock on SMP systems.  For the output timer (iptfs_timer):   - iptfs_destroy_state() holds x->lock, calls hrtimer_cancel()   - iptfs_delay_timer() callback takes x->lock  For the drop timer (drop_timer):   - iptfs_destroy_state() holds drop_lock, calls hrtimer_cancel()   - iptfs_drop_timer() callback takes drop_lock  Both timers use HRTIMER_MODE_REL_SOFT, so their callbacks run in softirq context.  When hrtimer_cancel() is called for a soft timer that is currently executing on another CPU, hrtimer_cancel_wait_running() spins on softirq_expiry_lock -- the same lock held by the softirq running the callback.  If the callback is blocked waiting for the spinlock held by the caller of hrtimer_cancel(), a circular dependency forms:    CPU 0: holds lock_A -> waits for softirq_expiry_lock   CPU 1: holds softirq_expiry_lock -> waits for lock_A  Fix by calling hrtimer_cancel() before acquiring the respective locks. hrtimer_cancel() is safe to call without holding any lock and will wait for any in-progress callback to complete.  For the output timer, the lock is still acquired afterwards to drain the packet queue.  For the drop timer, the lock/unlock pair is removed entirely since it only existed to serialize with the timer callback, which hrtimer_cancel() already guarantees.  Found by source code audit.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.0.13-1 | [DEBIAN-CVE-2026-53197](https://patchblox.com/security/data/fix/linux/debian-cve-2026-53197.md) | Jun 28, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.