Improper use of LSM sleepable hooks in the Linux kernel poses a high risk of system instability and potential security policy bypass.

This issue stems from the incorrect use of bpf_lsm_task_to_inode and bpf_lsm_inet_conn_established in sleepable LSM programs. These hooks are called from restricted contexts, such as rcu_read_lock or softirq context, where sleeping is forbidden, leading to invalid kernel operations.

Exploitation of this vulnerability allows a local attacker with low privileges to trigger kernel-level errors, potentially leading to a system crash or bypassing security policies enforced by LSMs. A CVSS score of 8.8 reflects the high danger posed by flaws that interfere with kernel security enforcement and system stability.

Immediate Action: Update the kernel to the patched versions (5.15.209, 6.1.175, 6.6.141, 6.12.91) or the latest version supplied by your distribution.

Proactive Monitoring: Watch for kernel panic events or unexpected system reboots that coincide with BPF program execution or LSM policy updates.

Compensating Controls: Audit and restrict the loading of eBPF programs, particularly those utilizing LSM hooks, until the kernel can be updated to a secure version.

Public Exploit Available: exploit_available (unknown)

This vulnerability highlights the risks associated with eBPF and LSM integration in the kernel. System administrators should prioritize updating to the specified versions to ensure that security hooks operate within their intended constraints and to maintain overall platform security.