Executive brief
The Linux kernel's BPF LSM (Linux Security Module) implementation allowed programs to attach to the xfrm_decode_session hook, which handles IPsec packet classification. A malicious or buggy BPF program could return an error from this hook, causing the kernel's packet classification routine to trigger a panic (BUG_ON), resulting in a denial of service affecting all network traffic on the system.
Technical details
The vulnerability is a denial-of-service flaw in the BPF LSM hook attachment mechanism. BPF programs were permitted to attach to the xfrm_decode_session() hook via bpf_lsm_xfrm_decode_session, but that hook may return error codes. However, security_skb_classify_flow() calls this hook from a void context and invokes BUG_ON() if an error is returned, immediately triggering a kernel panic. The root cause is missing validation preventing BPF attachment to hooks that must not fail. An attacker with BPF program loading capabilities (typically root or CAP_SYS_ADMIN) can craft a BPF LSM program that returns an error from xfrm_decode_session, causing an immediate system panic. The fix disables BPF attachment to this hook by adding it to the bpf_lsm_disabled_hooks list, preventing exploitation entirely.
Affected products
- Linux Linux kernel 5.8 and later (until patched)
Timeline
- 2026-08-28: disclosed
- 2026-06-22: patched