Recent Kernel exploits, attack surface reduction, example IPSEC

# security - Recent Kernel exploits, attack surface reduction, example IPSEC Source: [https://www.openwall.com/lists/oss-security/2026/05/16/3](https://www.openwall.com/lists/oss-security/2026/05/16/3) [](https://www.openwall.com/)- [Products](https://www.openwall.com/)- [Openwall GNU/\*/Linux*server OS*](https://www.openwall.com/Owl/) - [Linux Kernel Runtime Guard](https://www.openwall.com/lkrg/) - [John the Ripper*password cracker*](https://www.openwall.com/john/)- [Free & Open Source for any platform](https://www.openwall.com/john/) - [in the cloud](https://www.openwall.com/john/cloud/) - [Pro for Linux](https://www.openwall.com/john/pro/linux/) - [Pro for macOS](https://www.openwall.com/john/pro/macosx/) - [Wordlists*for password cracking*](https://www.openwall.com/wordlists/) - [passwdqc*policy enforcement*](https://www.openwall.com/passwdqc/)- [Free & Open Source for Unix](https://www.openwall.com/passwdqc/) - [Pro for Windows \(Active Directory\)](https://www.openwall.com/passwdqc/windows/) - [yescrypt*KDF & password hashing*](https://www.openwall.com/yescrypt/) - [yespower*Proof\-of\-Work \(PoW\)*](https://www.openwall.com/yespower/) - [crypt\_blowfish*password hashing*](https://www.openwall.com/crypt/) - [phpass*ditto in PHP*](https://www.openwall.com/phpass/) - [tcb*better password shadowing*](https://www.openwall.com/tcb/) - [Pluggable Authentication Modules](https://www.openwall.com/pam/) - [scanlogd*port scan detector*](https://www.openwall.com/scanlogd/) - [popa3d*tiny POP3 daemon*](https://www.openwall.com/popa3d/) - [blists*web interface to mailing lists*](https://www.openwall.com/blists/) - [msulogin*single user mode login*](https://www.openwall.com/msulogin/) - [php\_mt\_seed*mt\_rand\(\) cracker*](https://www.openwall.com/php_mt_seed/) - [Services](https://www.openwall.com/services/) - Publications- [Articles](https://www.openwall.com/articles/) - [Presentations](https://www.openwall.com/presentations/) - Resources- [Mailing lists](https://www.openwall.com/lists/) - [Community wiki](https://openwall.info/wiki/) - [Source code repositories \(GitHub\)](https://github.com/openwall) - [File archive & mirrors](https://www.openwall.com/mirrors/) - [How to verify digital signatures](https://www.openwall.com/signatures/) - [OVE IDs](https://www.openwall.com/ove/) - [What's new](https://www.openwall.com/news) [\[<prev\]](https://www.openwall.com/lists/oss-security/2026/05/16/2)[\[day\]](https://www.openwall.com/lists/oss-security/2026/05/16/)[\[month\]](https://www.openwall.com/lists/oss-security/2026/05/)[\[year\]](https://www.openwall.com/lists/oss-security/2026/)[\[list\]](https://www.openwall.com/lists/oss-security/)``` Message-ID: <[email protected]> Date: Sat, 16 May 2026 15:05:45 +0200 From: Hanno Böck <[email protected]> To: [email protected] Subject: Recent Kernel exploits, attack surface reduction, example IPSEC Hi, Multiple of the recent kernel exploits have affected the "esp" Linux Kernel module. ESP is, as far as I understand, part of IPSEC, and I think it's fair to say that IPSEC is not widely used these days. I think this raises some questions about attack surface. I want to note that I use IPSEC as an example here, but it likely applies in very similar ways to many features that are part of the Linux Kernel and are not used in most common setups. For everyone who builds custom kernels and doesn't use IPSEC, it's probably a good idea to disable all IPSEC-related config options, e.g.: CONFIG_INET_ESP CONFIG_INET6_ESP CONFIG_INET_AH CONFIG_INET6_AH I believe IPCOM is also rarely used separately from IPSEC, so consider also disabling these: CONFIG_INET_IPCOMP CONFIG_INET6_IPCOMP However, there's a broader point here: I think it's common these days that Linux distributions install most or all kernel modules by default, and loading them happens automatically. Which, in many cases, means people are potentially affected by security flaws in features they never use. "Attack surface reduction" is widely considered to be a good security principle, and I wonder if we can do better here. To pick the example of IPSEC, i wonder if it wouldn't be better to have, e.g., a separate "linux-modules-ipsec" package that isn't installed by default. People who use and need IPSEC will likely know that they need it, and can install it separately. I'm aware this doesn't come for free, and will add increased complexity to kernel packaging. But think about it like this: If we had that separation, three of the recent kernel local root exploits would've been much less impactful, and wouldn't have affected most systems. -- Hanno Böck - Independent security researcher https://itsec.hboeck.de/ https://badkeys.info/ ``` [Powered by blists](https://www.openwall.com/blists/)\-[more mailing lists](https://lists.openwall.net/) Please check out the[Open Source Software Security Wiki](https://oss-security.openwall.org/wiki/), which is counterpart to this[mailing list](https://oss-security.openwall.org/wiki/mailing-lists/oss-security)\. Confused about[mailing lists](https://www.openwall.com/lists/)and their use?[Read about mailing lists on Wikipedia](https://en.wikipedia.org/wiki/Electronic_mailing_list)and check out these[guidelines on proper formatting of your messages](https://www.complang.tuwien.ac.at/anton/mail-news-errors.html)\.