CVE-2026-80669

A flaw was found in the Linux kernel. A local attacker with the ability to load BPF (Berkeley Packet Filter) LSM (Linux Security Module) programs could exploit a vulnerability in the xfrm_decode_session hook. This could lead to a system panic, resulting in a Denial of Service (DoS).

A low severity denial of service flaw was found in the Linux kernel as shipped in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat In-Vehicle OS 2 (kernel and kernel-rt components). BPF LSM (Linux Security Module) programs could be attached to the xfrm_decode_session() hook. That hook may return an error, but security_skb_classify_flow() invokes it from a code path that cannot handle a return value and triggers a BUG_ON() when an error is returned. A local attacker with the ability to load and attach BPF LSM programs, which requires elevated privileges, could therefore turn packet classification into a kernel panic, crashing the system and causing a denial of service. Confidentiality and integrity are not affected, and the flaw is not reachable by an unauthenticated remote attacker because the malicious BPF LSM program must first be installed locally; network packets can only act as the runtime trigger after local attachment.

Red Hat Enterprise Linux 6 and 7 are not affected because the BPF LSM hook attachment code that introduced this flaw is not present in those releases.

Although the CVSS:3.1 base score is 5.5 (Moderate), Red Hat assesses the impact of this flaw as LOW because exploitation requires local access with privileges to load BPF LSM programs and the result is limited to denial of service. For this reason, fixes for the affected streams have been deferred to future planned updates; the residual risk is that a privileged local user could panic the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.