Linux Kernel Adds Killswitch Feature for Immediate Function Mitigation
Patch the kernel with CONFIG_KILLSWITCH and immediately engage the vulnerable function using the control interface to stop exploitation until a proper fix is available.
Patch the kernel to include CONFIG_KILLSWITCH, rebuild, and engage the vulnerable function immediately using the control interface.
Summary
A new kernel patch introduces a "killswitch" mechanism that lets privileged operators short‑circuit any kernel function by making it return a fixed value without executing its body. The feature is enabled via CONFIG_KILLSWITCH and relies on SECURITYFS, KPROBES with ftrace support, and FUNCTION_ERROR_INJECTION. Administrators can engage a function with a command such as
``` echo "engage af_alg_sendmsg -1" > /sys/kernel/security/killswitch/control ```
which causes af_alg_sendmsg() to return -EPERM on every call until the system reboots or the function is disengaged.
The interface exposes /sys/kernel/security/killswitch/ with sub‑directories per function, showing the return value, hit counts, and a list of currently engaged functions. Engaging a function also sets the TAINT_KILLSWITCH flag, marking the kernel as tainted until reboot. Boot parameters such as killswitch=fn1=val,fn2=val allow pre‑engagement during kernel init. The patch also handles module unloads by auto‑disengaging any engaged functions and emitting a warning.
This feature provides a rapid, temporary mitigation for security bugs that would otherwise require a full kernel rebuild and reboot, giving administrators time to deploy a proper patch.
Key changes
- Adds CONFIG_KILLSWITCH enabling per‑function short‑circuit via kprobe
- Provides /sys/kernel/security/killswitch/ interface with engage/disengage commands
- Engaging a function returns the supplied value immediately, skipping its body
- First engagement sets TAINT_KILLSWITCH and persists until reboot
- Boot parameter killswitch=fn1=val,fn2=val allows pre‑engagement
- Module unload auto‑disengages engaged functions and logs a warning
- Example: echo "engage af_alg_sendmsg -1" > /sys/kernel/security/killswitch/control
- Engaged functions are listed in /sys/kernel/security/killswitch/engaged