BPF LSM (Linux Security Module) programs were allowed to attach to the kernel hook xfrm_decode_session(). When this hook returned an error, the calling function security_skb_classify_flow() invoked BUG_ON() in a void execution path. Because BUG_ON aborts execution, the kernel paniced. An attacker who can load BPF programs could trigger this panic, rendering the system inoperable and denying legitimate network traffic. The weakness is an improper handling of a failure condition within the kernel’s packet classification logic, leading to crash.

The vulnerability affects the Linux kernel on all distributions that ship the BPF LSM framework. Any kernel release before the patch that disables BPF attachment to xfrm_decode_session is susceptible; specific release numbers are not enumerated in the CVE data.

The issue carries a high severity impact, producing a full kernel crash. No public exploits have been reported, and the EPSS score is unavailable, indicating a low or unknown exploitation probability at present. However, the vulnerability requires the ability to load BPF LSM programs, which typically demands privileged access. Because the exploit can cause a system-wide denial of service, prompt remediation is recommended. The CVE is not listed in the CISA KEV catalog.