CVE-2026-80669: Linux Kernel BPF LSM DOS Vulnerability

CVE-2026-80669 Overview

CVE-2026-80669 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) Linux Security Module (LSM) subsystem. The flaw allows BPF LSM programs to attach to the xfrm_decode_session() hook. That hook can return an error, but security_skb_classify_flow() invokes it from a void code path that triggers BUG_ON() when an error is returned. A BPF LSM program returning an error from this hook converts a packet classification event into a full kernel panic. The fix disables BPF attachment to xfrm_decode_session() to prevent denial of service through IPsec packet processing.

Critical Impact
A privileged local user loading a crafted BPF LSM program can trigger a kernel BUG_ON() panic during IPsec packet classification, resulting in denial of service.

Affected Products

Linux kernel builds with CONFIG_BPF_LSM enabled
Linux kernel builds with CONFIG_XFRM (IPsec) enabled
Distributions shipping affected mainline and stable branches prior to the referenced commits

Discovery Timeline

2026-08-28 - CVE-2026-80669 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80669

Vulnerability Analysis

The vulnerability resides in the interaction between the BPF LSM framework and the XFRM (IPsec transform) packet classification path. BPF LSM programs can attach to arbitrary LSM hooks exported by the kernel. The xfrm_decode_session() hook is exported as an attachable LSM hook, so a BPF LSM program can register against it and influence its return value.

The caller security_skb_classify_flow() invokes xfrm_decode_session() from a context that returns void. The kernel treats any nonzero return as an unrecoverable state and triggers BUG_ON(). Under BUG_ON(), the kernel executes a bug trap that terminates the current context and, depending on configuration, panics the system.

An attacker with the capability to load BPF LSM programs (typically requiring CAP_SYS_ADMIN or CAP_BPF plus CAP_NET_ADMIN) can register a program that returns an error from xfrm_decode_session(). Subsequent IPsec traffic classification then trips the BUG_ON(), causing a kernel panic and denial of service.

Root Cause

The root cause is an inconsistency between the hook contract and the caller. xfrm_decode_session() may return an error, but security_skb_classify_flow() treats the return path as void and asserts absence of errors via BUG_ON(). Exposing the hook to BPF LSM attachment lets user-controlled logic drive that assertion path.

Attack Vector

Exploitation requires local privileges sufficient to load BPF LSM programs. After attachment, any packet flow traversing the XFRM classification path can trigger the panic. The kernel maintainers resolved the issue by disabling BPF attachment to xfrm_decode_session(), removing the ability of BPF LSM programs to influence its return value. See the upstream fixes referenced under Kernel Git Commit AA265D47 and Kernel Git Commit 6B44C666.

No verified public exploitation code is available. The vulnerability mechanism is described in prose based on the upstream commit message.

Detection Methods for CVE-2026-80669

Indicators of Compromise

Unexpected kernel panic entries in /var/log/kern.log or dmesg referencing BUG_ON within security_skb_classify_flow or xfrm_decode_session.
Loaded BPF LSM programs attached to LSM hook xfrm_decode_session as reported by bpftool prog show and bpftool link show.
Sudden host reboots on systems processing IPsec traffic shortly after BPF program load events.

Detection Strategies

Audit BPF program load events via the kernel audit subsystem (AUDIT_BPF) and alert on LSM-type programs attaching to network-related hooks.
Correlate bpf(BPF_PROG_LOAD) and bpf(BPF_LINK_CREATE) syscalls with subsequent kernel oops or panic events.
Baseline the set of BPF LSM programs on production hosts and flag additions outside change management.

Monitoring Recommendations

Ship dmesg and kernel crash dumps to a central logging system for oops and BUG_ON pattern matching.
Monitor uptime regressions on hosts running strongSwan, libreswan, or other IPsec workloads.
Track CAP_BPF, CAP_SYS_ADMIN, and CAP_NET_ADMIN grants to workloads and containers.

How to Mitigate CVE-2026-80669

Immediate Actions Required

Apply the upstream stable kernel updates that include the referenced commits and reboot affected hosts.
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted administrators and remove these capabilities from container workloads that do not require them.
Inventory existing BPF LSM programs and remove any attached to xfrm_decode_session.

Patch Information

The fix disables BPF program attachment to the xfrm_decode_session LSM hook. Backports are available across stable branches. Reference the upstream commits: Kernel Git Commit 12091470, Kernel Git Commit 1BB3B6A5, Kernel Git Commit 49FA1BE6, Kernel Git Commit 4AE780D1, Kernel Git Commit 6B44C666, and Kernel Git Commit AA265D47.

Workarounds

Disable CONFIG_BPF_LSM on kernels where BPF LSM functionality is not required.
Enforce kernel.unprivileged_bpf_disabled=1 via sysctl to reduce the surface for unprivileged BPF loading.
Use seccomp and Linux capabilities to prevent workloads from issuing bpf() syscalls with LSM attach types.

bash

# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
echo "kernel.unprivileged_bpf_disabled=1" >> /etc/sysctl.d/99-bpf-hardening.conf

# Inspect existing BPF LSM attachments
bpftool prog show | grep -i lsm
bpftool link show