CVE-2026-80669
In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrm_decode_session hook attachment BPF LSM programs can currently attach to xfrm_decode_session(). That hook may return an error, but security_skb_classify_flow() calls it from a void path and triggers BUG_ON() if an error is returned. Disable BPF attachment to the hook to prevent a BPF LSM program from turning packet classification into a full panic.
Affected versions
Linux kernel versions
5.7
and later are affected. Fixed in
6.1.178,
6.6.145,
6.12.97,
6.18.40,
7.1.5,
7.2
and their respective stable series.
References
6 totalFrequently asked questions
-
What is CVE-2026-80669?
CVE-2026-80669 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.7 onward and has been patched in 6.1.178, 6.6.145, 6.12.97 and others. CVE-2026-80669 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-80669?
Yes. CVE-2026-80669 has been patched. Fixed versions include 6.1.178, 6.6.145, 6.12.97 and others. If you are running Linux kernel 5.7 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-80669 actively exploited?
No. CVE-2026-80669 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.