net: check kern before calling security subsystem