Briefing

Linux Kernel Adds Killswitch Feature for Immediate Function Mitigation

security
by signa11 ·

Patch the kernel with CONFIG_KILLSWITCH and immediately engage the vulnerable function using the control interface to stop exploitation until a proper fix is available.

What to do now

Patch the kernel to include CONFIG_KILLSWITCH, rebuild, and engage the vulnerable function immediately using the control interface.

Summary

A new kernel patch introduces a "killswitch" mechanism that lets privileged operators short‑circuit any kernel function by making it return a fixed value without executing its body. The feature is enabled via CONFIG_KILLSWITCH and relies on SECURITYFS, KPROBES with ftrace support, and FUNCTION_ERROR_INJECTION. Administrators can engage a function with a command such as

``` echo "engage af_alg_sendmsg -1" > /sys/kernel/security/killswitch/control ```

which causes af_alg_sendmsg() to return -EPERM on every call until the system reboots or the function is disengaged.

The interface exposes /sys/kernel/security/killswitch/ with sub‑directories per function, showing the return value, hit counts, and a list of currently engaged functions. Engaging a function also sets the TAINT_KILLSWITCH flag, marking the kernel as tainted until reboot. Boot parameters such as killswitch=fn1=val,fn2=val allow pre‑engagement during kernel init. The patch also handles module unloads by auto‑disengaging any engaged functions and emitting a warning.

This feature provides a rapid, temporary mitigation for security bugs that would otherwise require a full kernel rebuild and reboot, giving administrators time to deploy a proper patch.

Key changes

  • Adds CONFIG_KILLSWITCH enabling per‑function short‑circuit via kprobe
  • Provides /sys/kernel/security/killswitch/ interface with engage/disengage commands
  • Engaging a function returns the supplied value immediately, skipping its body
  • First engagement sets TAINT_KILLSWITCH and persists until reboot
  • Boot parameter killswitch=fn1=val,fn2=val allows pre‑engagement
  • Module unload auto‑disengages engaged functions and logs a warning
  • Example: echo "engage af_alg_sendmsg -1" > /sys/kernel/security/killswitch/control
  • Engaged functions are listed in /sys/kernel/security/killswitch/engaged

Affects

internal

Customer impact

Analyzing matches…

Ask about this story

Impact on an agency? Which customers? Compare historically Risks of waiting