mquire

mquire mquire，由 memory 和 inquire 组合而成，是一款受 osquery 启发而开发的内存查询工具。 核心优势：无需外部调试符号 mquire 可以在不需要外部调试符号的情况下分析 Linux 内核内存快照。 分析所需的一切都已嵌入内存转储本身。这意味着你可以分析： 从未见过的未知或定制内核 无需准备的任何 Linux 发行版 外部调试符号不可用或丢失的内存快照 要求 内核版本要求 ： BTF 支持 ：内核 4.18 或更新版本，并启用了 BTF（大多数现代发行版默认启用） Kallsyms 支持 ：内核 6.4 或更新版本（由于...

krie

KRIe KRIe 是一个研究项目，旨在通过 eBPF 检测 Linux 内核漏洞利用。KRIe 远非万无一失的策略：从 eBPF 相关的限制到可能依赖被攻破内核来发出安全事件的后利用检测，显然，一个动机明确的攻击者最终能够绕过它。 尽管如此，该项目的目标是让攻击者的日子更难过，并最终阻止现成的漏洞利用在易受攻击的内核上生效。 KRIe 使用 CO-RE（一次编译，到处运行） 开发，因此兼容大量内核版本。如果你的内核未导出 BTF 调试信息，KRIe 将尝试从 BTFHub 自动下载。如果你的内核在 BTFHub 上不可用，但你已经能够手动生成内核的 BTF...

cve-2024-23113-poc

CVE-2024-23113-poc CVE-2024-23113 是一个在 Linux Kernel 中被发现的漏洞，它属于 任意代码执行漏洞 ，影响了 bpf Berkeley Packet Filter 子系统。具体来说，这个漏洞影响了 bpf 程序的 bpfprog 类型的对象，并且可以允许攻击者通过构造恶意的 BPF 程序来在内核空间执行恶意代码。 漏洞原理： 1. BPF Berkeley Packet Filter 是一个在 Linux 内核中用于数据包捕获和网络流量分析的框架。它允许用户程序通过加载 BPF...

CVE-2026-98065

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A local user can cause a Denial of Service DoS by creating a hash map lacking key type information and reading it through the BPF file system. Due to missing validation of BPF Type Format BTF metadata, the kernel attempt...

CVE-2026-98064

A flaw was found in the Linux kernel. A local user can cause a Denial of Service DoS and crash the system by running a specially crafted BPF Berkeley Packet Filter program. The issue occurs within the BPF Type Format BTF component when attempting to display data referencing a void data type, whic...

CVE-2026-98063

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. When formatting data using BPF Type Format BTF, the kernel attempts to access type identifiers without checking if they are initialized. A local user with permissions to execute BPF programs can exploit this vulnerabilit...

AZL-104492 CVE-2026-98063 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref in btfvarshow btfvarshow calls btftypeidresolve unconditionally, which dereferences btf-resolvedids. That is NULL for a base BTF - e.g. the vmlinux BTF that bpfsnprintfbtf renders against - since base BTF ...

CVE-2026-98065

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...

CVE-2026-98065 bpf: Reject key-less BTF for hash maps

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...

CVE-2026-98065

The Linux kernel contains a vulnerability where key-less BTF (Type ID 0) can be created for hash maps (htab and rhtab ). This occurs because these maps gained a ->map_check_btf callback that fails to validate the key, allowing the creation of maps that were previously rejected. When reading th...

EUVD-2026-86718

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...

EUVD-2026-86717

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref when showing a void BTF type btfmodifiershow resolves the modifier and then calls btftypeopst-show unconditionally. For the void type typeid 0, BTFKINDUNKN kindops has no entry, so -show is NULL. A "const...

CVE-2026-98064

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref when showing a void BTF type btfmodifiershow resolves the modifier and then calls btftypeopst-show unconditionally. For the void type typeid 0, BTFKINDUNKN kindops has no entry, so -show is NULL. A "const...

CVE-2026-98065

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...

Linux Distros Unpatched Vulnerability : CVE-2026-98063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix NULL-ptr-deref in btfvarshow btfvarshow calls btftypeidresolve unconditionally, which dereferences btf-resolvedids. That is NULL for a base BTF - e.g...

Linux Distros Unpatched Vulnerability : CVE-2026-93144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess lets program-type btfstructaccess callbacks validate writes before the default BTF access...

CVE-2026-93144

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess lets program-type btfstructaccess callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy fo...

DEBIAN-CVE-2026-93144

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess lets program-type btfstructaccess callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy fo...

AZL-102632 CVE-2026-93148 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject MEMALLOC BTF accesses past object bounds BTF struct walks relax the struct-size check for accesses through a trailing flexible array. That is valid for ordinary BTF type walking, but PTRTOBTFID | MEMALLOC values point...

CVE-2026-92515

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve unique-field state across nested structs btffindstructfield initializes a fresh seen mask for every recursive descent. Unique special fields in different levels of the same aggregate therefore do not see one another...