CVE-2026-80669 bpf: Disable xfrm_decode_session hook attachment
A local attacker with high privileges can attach a BPF LSM program to xfrm_decode_session to trigger a kernel panic, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80669?
CVE-2026-80669 is a denial of service vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disable xfrm_decode_session hook attachment
BPF LSM programs can currently attach to xfrm_decode_session(). That hook may return an error, but security_skb_classify_flow() calls it from a void path and triggers BUG_ON() if an error is returned.
Disable BPF attachment to the hook to prevent a BPF LSM program from turning packet classification into a full panic.
Which versions are affected by CVE-2026-80669?
How do I fix CVE-2026-80669?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-80669 being exploited?
There is no known exploitation of CVE-2026-80669 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80669, DEBIAN-CVE-2026-80669, GHSA-qx3x-jwr3-p8vv, UBUNTU-CVE-2026-80669.