CVE-2026-80669

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

bpf: Disable xfrm_decode_session hook attachment

BPF LSM programs can currently attach to xfrm_decode_session(). That hook may return an error, but security_skb_classify_flow() calls it from a void path and triggers BUG_ON() if an error is returned.

Disable BPF attachment to the hook to prevent a BPF LSM program from turning packet classification into a full panic.

Affected product:

AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , Debian 10 ELS , Debian 11 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU

Affected packages:

linux @ 5.10.259 (+8 more)

Live-patch status from KernelCare for each operating system.