BPF LSM programs can attach to the xfrm_decode_session hook, which may return an error. The security_skb_classify_flow() function calls this hook from a void path and triggers a BUG_ON when an error is returned, causing a kernel panic. The vulnerability is caused by an unchecked return value (CWE‑252), resulting in a system crash that effectively denies service.

The vulnerability affects all Linux kernel builds that include the BPF LSM framework and the xfrm_decode_session hook, such as the standard upstream Linux kernel. Any system running a kernel version prior to the commit that disables BPF attachment to this hook is susceptible, regardless of distribution or custom kernel modifications.

The CVSS score is 5.5, indicating a medium severity impact, and the EPSS score is less than 1 %, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is privileged or elevated execution that allows loading a malicious BPF LSM program, which could trigger a kernel panic when the xfrm_decode_session hook returns an error. The consequence is a full kernel crash that results in denial of service.