CVE-2026-80669

A low severity denial of service flaw was found in the Linux kernel as shipped in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat In-Vehicle OS 2 (kernel and kernel-rt components). BPF LSM (Linux Security Module) programs could be attached to the xfrm_decode_session() hook. That hook may return an error, but security_skb_classify_flow() invokes it from a code path that cannot handle a return value and triggers a BUG_ON() when an error is returned. A local attacker with the ability to load and attach BPF LSM programs, which requires elevated privileges, could therefore turn packet classification into a kernel panic, crashing the system and causing a denial of service. Confidentiality and integrity are not affected, and the flaw is not reachable by an unauthenticated remote attacker because the malicious BPF LSM program must first be installed locally; network packets can only act as the runtime trigger after local attachment.

Red Hat Enterprise Linux 6 and 7 are not affected because the BPF LSM hook attachment code that introduced this flaw is not present in those releases.

Although the CVSS:3.1 base score is 5.5 (Moderate), Red Hat assesses the impact of this flaw as LOW because exploitation requires local access with privileges to load BPF LSM programs and the result is limited to denial of service. For this reason, fixes for the affected streams have been deferred to future planned updates; the residual risk is that a privileged local user could panic the system.