CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's ability to handle BPF LSM programs attached to the xfrm_decode_session hook, which can lead to system crashes if an error is returned during packet classification. This can result in a denial of service, as the system may panic under certain conditions. Linux system administrators and developers utilizing BPF in their security modules should prioritize addressing this issue to ensure system stability and security.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrm_decode_session hook attachment BPF LSM programs can currently attach to xfrm_decode_session(). That hook may return an error, but security_skb_classify_flow() calls it from a void path and triggers BUG_ON() if an error is returned. Disable BPF attachment to the hook to prevent a BPF LSM program from turning packet classification into a full panic.