copy-fail-blocker

copy-fail-blocker CVE-2026-31431（「Copy Fail」）および Dirty Frag の RxRPC 亜種、ならびに AFALG または AFRXRPC ソケットファミリ経由で到達可能なカーネル側インプレース暗号パスへのユーザー空間アクセスに依存する類似の権限昇格脆弱性に対する BPF-LSM 緩和策です。 小さな DaemonSet が、すべてのノードの socketcreate フックに単一の BPF-LSM プログラムをアタッチします。このプログラムは、プロセスのケーパビリティ、名前空間、seccomp プロファイルに関係なく、ユーザー空間 からの...

block-copyfail

概要 CVE-2026-31431（「Copy Fail」）は、Linuxカーネルのalgifaead暗号インターフェースにおける権限昇格の脆弱性です。攻撃者はauthencesnアルゴリズムを使用したAFALGソケットとspliceを利用して、カーネルページキャッシュ内の任意のファイル（/usr/bin/suなどのsetuidバイナリを含む）を破損させることができます。 本ドキュメントでは、Copy Failで悪用されるサブシステムであるAFALG AEADバインドをすべてブロックするBPF LSM DaemonSetを使用した、再起動不要の修復策...

block-copyfail

block-copyfail 概念验证 针对 CVE-2026-31431（“Copy Fail”）的运行时缓解方案——一种通过 algifaead 中的 authencesn 加密模板实现的 Linux 内核权限提升漏洞。 与模块黑名单不同，此方案无需重启 。一个 BPF LSM 程序挂接 socketbind 并阻止所有 AFALG AEAD 绑定——即 Copy Fail 所利用的子系统。这可以防止通过加密模板嵌套（例如 pcryptauthencesn...）实现的绕过。其他 AFALG 用法（hash、skcipher）不受影响。 被阻止的尝试会实时记录，包含...

deny-af-alg-bpf

deny-af-alg-bpf 説明 AFALG（Linuxカーネル暗号API）ソケットの作成をブロックし、すべての試行をリングバッファ経由でユーザースペースにログ記録するBPF LSMプログラムです。 機能 lsm/socketcreate フックにアタッチします socketAFALG, ... 呼び出しを -EPERM で拒否します 構造化イベント（pid、comm）をBPFリングバッファに出力します ユーザースペースデーモンがリングバッファを読み取り、stderrにログ記録します（systemdジャーナルで処理されます） コンポーネント プログラム denyafalg.bpf.c...

PT-2026-94969

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF LSM component where security bpf prog free is called via bpf prog put rcu, which serves as the call rcu callback for non-sleepable programs. This sequence...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2143)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2143 advisory. In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: always decrease sk refcount CVE-2026-46158 In the Linux kernel, the following vulnerability has been...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: always decrease sk refcount CVE-2026-46158 In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: free sk if last CVE-2026-46170 In the Linux kernel, th...

CVE-2026-80669

A flaw was found in the Linux kernel. A local attacker with the ability to load BPF Berkeley Packet Filter LSM Linux Security Module programs could exploit a vulnerability in the xfrmdecodesession hook. This could lead to a system panic, resulting in a Denial of Service DoS...

Important: kernel6.18

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: afunix: Drop all SCM attributes for SOCKMAP. CVE-2026-53005 In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing locking around retry adding new subreqs CVE-2026-64068 In the Linu...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2071)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2071 advisory. In the Linux kernel, the following vulnerability has been resolved: afunix: Drop all SCM attributes for SOCKMAP. CVE-2026-53005 In the Linux kernel, the following vulnerability has been...

SUSE CVE-2026-80669

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80669

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

UBUNTU-CVE-2026-80669

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80669

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80669 bpf: Disable xfrm_decode_session hook attachment

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

EUVD-2026-67545

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80669

This Linux kernel vulnerability affects the interaction between BPF LSM programs and the xfrm_decode_session() hook. BPF LSM programs can attach to this hook, which may return an error. However, security_skb_classify_flow() invokes the hook from a void path and triggers a BUG_ON() if an error is ...

CVE-2026-80669 bpf: Disable xfrm_decode_session hook attachment

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80669: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

PT-2026-82969

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description BPF LSM programs can attach to the xfrm decode session hook. Because security skb classify flow calls this hook from a void path, any error returned by the hook triggers a BUG ON...