CVE-2026-80669: bpf: Disable xfrm_decode_session hook attachment
Published Aug 28, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disable xfrmdecodesession hook attachment
BPF LSM programs can currently attach to xfrmdecodesession(). That hook may return an error, but securityskbclassifyflow() calls it from a void path and triggers BUGON() if an error is returned.
Disable BPF attachment to the hook to prevent a BPF LSM program from turning packet classification into a full panic.
Affected Software
1 affected component
Linux Linux kernel
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable BPF attachment to the xfrm_decode_session() hook to prevent BPF LSM programs from attaching there.
Linux kernel BPF LSM Disable BPF attachment to xfrm_decode_session() hook = enabled
Event History
Aug 28, 2026
CVE Published
via MITRE·06:49 AM
Data Sourced
via MITRE·06:49 AM
Description