mquire

mquire mquire, a play on the memory and inquire words, is a memory querying tool inspired by osquery. Key advantage: No external debug symbols needed mquire can analyze Linux kernel memory snapshots without requiring external debug symbols. Everything needed for analysis is already embedded in th...

krie

KRIe KRIe is a research project that aims to detect Linux Kernel exploits with eBPF. KRIe is far from being a bulletproof strategy: from eBPF related limitations to post exploitation detections that might rely on a compromised kernel to emit security events, it is clear that a motivated attacker...

cve-2024-23113-poc

CVE-2024-23113-poc CVE-2024-23113 is a vulnerability discovered in the Linux Kernel , classified as an arbitrary code execution vulnerability that affects the bpf Berkeley Packet Filter subsystem. Specifically, this vulnerability affects objects of the bpfprog type in bpf programs, and can allow ...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref when showing a void BTF type btfmodifiershow resolves the modifier and then unconditionally calls btftypeopst-show. For the void type typeid 0, BTFKINDUNKN, there is no entry in kindops, so -show returns...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess allows program-type btfstructaccess callbacks to validate writes prior to the default BTF access path rejecting non-read accesses. This bypasses the read-only...

CVE-2026-100074

A flaw was found in the Linux kernel's extended Berkeley Packet Filter eBPF subsystem. The BPF Type Format BTF validator failed to enforce that reference count bpfrefcount fields are unique within data structures. A local user with permissions to load eBPF programs could exploit this flaw by...

CVE-2026-93148

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component. This vulnerability arises from incorrect boundary checks during BPF Type Format BTF struct walks for memory-allocated objects. Specifically, the system fails to reject accesses that extend beyond the allocated object's...

CVE-2026-93138

A flaw was found in the Linux kernel. Specifically, a race condition exists within the Berkeley Packet Filter BPF subsystem when preparing vmlinux BPF Type Format BTF data. This issue occurs because the system can publish a pointer to the BTF data before its contents are fully visible, allowing...

SUSE CVE-2026-98813

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor duplicates map-record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for...

UBUNTU-CVE-2026-98813

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor duplicates map-record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for...

CVE-2026-98813

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor duplicates map-record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for...

CVE-2026-98813 bpf: Hold map BTF for the memory allocator destructor record

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor duplicates map-record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for...

CVE-2026-98813 bpf: Hold map BTF for the memory allocator destructor record

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor duplicates map-record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for...

CVE-2026-98813

The Linux kernel contains a vulnerability where the bpf memory allocator fails to maintain a reference to the map BTF within the destructor record. When bpf_mem_alloc_destroy() defers a final drain to a workqueue, bpf_map_free() may free the map's BTF while the worker still holds a duplicate reco...

PT-2026-116866

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A divide-by-zero issue exists in the btf struct walk function. This occurs during program load time when an access extends beyond a structure and the final member is a flexible array. Th...

PT-2026-128562

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btf struct walk When an access goes past the struct and the last member is a flexible array, btf struct walk folds the offset back into a single element with off - moff % t-size, but never checks that t...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions 6.12.112 to 6.13, 6.18.55 to 6.19, and 7.0. These vulnerabilities stem from the function bpfmasetdtor, which copies map-record but does not maintain the BTF reference within the destructor context. As a result, the working queue still...

CVE-2026-98065

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A local user can cause a Denial of Service DoS by creating a hash map lacking key type information and reading it through the BPF file system. Due to missing validation of BPF Type Format BTF metadata, the kernel attempt...

CVE-2026-98064

A flaw was found in the Linux kernel. A local user can cause a Denial of Service DoS and crash the system by running a specially crafted BPF Berkeley Packet Filter program. The issue occurs within the BPF Type Format BTF component when attempting to display data referencing a void data type, whic...

CVE-2026-98063

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. When formatting data using BPF Type Format BTF, the kernel attempts to access type identifiers without checking if they are initialized. A local user with permissions to execute BPF programs can exploit this vulnerabilit...