{"id":"CVE-2026-80669","title":"bpf: Disable xfrm_decode_session hook attachment","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disable xfrm_decode_session hook attachment\n\nBPF LSM programs can currently attach to xfrm_decode_session(). That\nhook may return an error, but security_skb_classi…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 9e4e01dfd3254c7f04f24b7c6b29596bc12332f3 < aa265d47308775c5501073b08133623bcb5421f9","Linux >= 9e4e01dfd3254c7f04f24b7c6b29596bc12332f3 < 6b44c6660aa1c9b843e450a623ac4a8484919dce","Linux >= 9e4e01dfd3254c7f04f24b7c6b29596bc12332f3 < 4ae780d173ef40d4f7cb76935dc2d55fbf380009","Linux >= 9e4e01dfd3254c7f04f24b7c6b29596bc12332f3 < 49fa1be621dde8f526d36e5791aded8fafda1e9c","Linux >= 9e4e01dfd3254c7f04f24b7c6b29596bc12332f3 < 1bb3b6a5c3c5cc814eae4ff0212fdced36f8bce9","Linux >= 9e4e01dfd3254c7f04f24b7c6b29596bc12332f3 < 12091470c6b4c1c14b2de12dcbae2ada6cb6d20b","Linux 5.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T17:02:38.695836Z"},"published":"2026-08-28","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:05:52.800Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80669","references":[{"url":"https://git.kernel.org/stable/c/aa265d47308775c5501073b08133623bcb5421f9"},{"url":"https://git.kernel.org/stable/c/6b44c6660aa1c9b843e450a623ac4a8484919dce"},{"url":"https://git.kernel.org/stable/c/4ae780d173ef40d4f7cb76935dc2d55fbf380009"},{"url":"https://git.kernel.org/stable/c/49fa1be621dde8f526d36e5791aded8fafda1e9c"},{"url":"https://git.kernel.org/stable/c/1bb3b6a5c3c5cc814eae4ff0212fdced36f8bce9"},{"url":"https://git.kernel.org/stable/c/12091470c6b4c1c14b2de12dcbae2ada6cb6d20b"}],"tags":["cve.org"],"epss":0.00215,"epssPercentile":0.11896,"ingestedAt":"2026-11-06T18:00:12.536Z","slug":"CVE-2026-80669","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disable xfrm_decode_session hook attachment\n\nBPF LSM programs can currently attach to xfrm_decode_session(). That\nhook may return an error, but security_skb_classify_flow() calls it\nfrom a void path and triggers BUG_ON() if an error is returned.\n\nDisable BPF attachment to the hook to prevent a BPF LSM program from\nturning packet classification into a full panic.\n\n## Affected\n\n- `Linux >= 9e4e01dfd3254c7f04f24b7c6b29596bc12332f3 < aa265d47308775c5501073b08133623bcb5421f9`\n- `Linux >= 9e4e01dfd3254c7f04f24b7c6b29596bc12332f3 < 6b44c6660aa1c9b843e450a623ac4a8484919dce`\n- `Linux >= 9e4e01dfd3254c7f04f24b7c6b29596bc12332f3 < 4ae780d173ef40d4f7cb76935dc2d55fbf380009`\n- `Linux >= 9e4e01dfd3254c7f04f24b7c6b29596bc12332f3 < 49fa1be621dde8f526d36e5791aded8fafda1e9c`\n- `Linux >= 9e4e01dfd3254c7f04f24b7c6b29596bc12332f3 < 1bb3b6a5c3c5cc814eae4ff0212fdced36f8bce9`\n- `Linux >= 9e4e01dfd3254c7f04f24b7c6b29596bc12332f3 < 12091470c6b4c1c14b2de12dcbae2ada6cb6d20b`\n- `Linux 5.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}