Kernel panic "Missing ENDBR" or kernel module fails to load when installing SEP 14.3 RU9 on RHEL 10

Products

• Endpoint Protection
• Endpoint Security
• Endpoint Security Complete

Issue/Introduction

When installing Symantec Endpoint Protection (SEP) 14.3 RU9 on Red Hat Enterprise Linux (RHEL) 10, a kernel panic occurs during installation and kernel modules fail to load with a status of not loaded.

Checking the agent status reveals that core kernel modules are not loaded:

Daemon status:
  cafagent            running
  sisamdagent         running
  sisidsagent         running
  sisipsagent         running
  sisevtd             running

Module status:
  sisevt              not loaded
  sisap               not loaded

Reviewing sisap_init.log shows errors similar to the following:

insmod: ERROR: could not insert module /etc/symantec/sis/driver/.../sisap-x86_64-default.ko: Unknown symbol in module
sisap.init: error loading Symantec Agent for Linux AP driver

Reviewing kernel crash logs (vmcore-dmesg.txt / dmesg) reveals a fault during module initialization:

Missing ENDBR: kallsyms_lookup_name+0x0/0xd0
kernel BUG at arch/x86/kernel/cet.c:102!

Environment

• SEP 14.3 RU9
• RHEL 10
• Bare-metal / physical hardware supporting Intel Control-flow Enforcement Technology (CET) / Indirect Branch Tracking (IBT)

Resolution

Our Engineering team is investigating this issue and will update this document when a solution becomes available.

Workaround:

To prevent kernel panics, adjust the Linux kernel boot parameter to relax IBT enforcement.
For additional details regarding this kernel parameter, refer to Red Hat Solution 7131503 : Kernel panic with `Missing ENDBR`.