EUVD-2026-82000

In the Linux kernel, the following vulnerability has been resolved: powerpc/syscall: Fix syscall skip handling for seccomp and ptrace After enabling GENERICENTRY on PowerPC, syscallenterfromusermode returns -1 as a sentinel to signal that seccomp or ptrace has intercepted the syscall and already...

EUVD-2026-82008

In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: Keep 'origx0' in-sync with x0 on syscall entry Commit e057b9477232 "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" attempted to resolve a long-standing issue with syscall entry tracing, where ...

docker_escape_pwn

Escape from Docker using CVE-2017-1000112 and CVE-2017-18344. Including: gaining root privilage get all capbilities namespace recovery filesystem recovery cgroup limitation bypass seccomp bypass...

kafel

WHAT IS IT? Kafel is a language and library for specifying syscall filtering policies. The policies are compiled into BPF code that can be used with seccomp-filter. This is NOT an official Google product. Usage With verbose error reporting root@kitploit: struct sockfprog prog; kafelctxtt ctxt =...

CVE-2026-90347

CVE-2026-90347 affects the Linux kernel's arm64 ptrace subsystem. A previous fix (commit e057b9477232) was incomplete: it failed to update orig_x0 when a tracer modifies x0 during a SECCOMP_RET_TRACE ptrace exit, before the seccomp filter is re-evaluated. This allows a tracer to manipulate the fi...

CVE-2026-90339

CVE-2026-90339 is a Linux kernel vulnerability affecting the PowerPC architecture (both ppc32 and ppc64). After enabling GENERIC_ENTRY , the sentinel value -1 returned by syscall_enter_from_user_mode() to indicate that seccomp or ptrace had already set a return value was not handled correctly in ...

Z-Jail

Z-Jail Multi-layer sandbox for native code execution on Linux. Seven independent defence layers — no external dependencies, 73 KiB PIE binary. root@kitploit: ┌──────────────────────────────────────────────────────┐ │ Z-Jail │ ├──────────────────────────────────────────────────────┤ │ Truthimatics...

seccomp-tools

Seccomp Tools Powerful tools for seccomp analysis. This project is aimed primarily but not exclusively at analyzing seccomp sandboxes in CTF pwn challenges. Some features are CTF-specific, but they're just as useful for analyzing real-world seccomp filters. Features Dump - Automatically dumps...

container-cve-2021-22555

Reproducer for CVE-2021-22555 as a container First, this rolls in the exploit code from here as a handy pre-built container: https://github.com/google/security-research/tree/master/pocs/linux/cve-2021-22555 Pre-built container: quay.io/cgwalters/cve-2021-22555 Mitigation: seccomp profiles A stron...

cargo-fuzz

cargo fuzz Acargo subcommand for fuzzing with libFuzzer! Easy to use! Installation root@kitploit: $ cargo install cargo-fuzz Note: libFuzzer needs LLVM sanitizer support, so this only works on x86-64 and Aarch64, and only on Unix-like operating systems not Windows. This also needs a nightly...

cve-2022-0185-crash-poc

Container running cve-2022-0185 crash POC This is a docker container that runs the crash POC from https://www.willsroot.io/2022/01/cve-2022-0185.html. The container runs unprivileged as UID 65534. You can also use docker run -u or set a security context with RunAsUser additionally, all should yie...

Hulios

Hulios Hardened Universal Linux Invisibility and Onion System Hulios is an eBPF-powered, transparent Tor VPN gateway for Linux. It secures outbound network traffic by redirecting TCP sockets and DNS queries through an embedded Arti Tor client instance and a localized Hickory-based DNS resolver. B...

firejail

Firejail Firejail is a lightweight security tool intended to protect a Linux system by setting up a restricted environment for running potentially untrusted applications. More specifically, it is an SUID sandbox program that reduces the risk of security breaches by using Linux namespaces,...

seccomp-tools

Seccomp Tools seccomp 解析のための強力なツール群です。 このプロジェクトは主に（ただし排他的ではなく）CTF pwn チャレンジにおける seccomp サンドボックスの解析を目的としています。 一部の機能は CTF 特有のものですが、実世界の seccomp フィルタの解析にも同様に役立ちます。 機能 Dump - 実行ファイルから seccomp BPF を自動的にダンプします。 Disasm - seccomp BPF を人間が読みやすい形式に変換します。 簡易的な逆コンパイルに対応。 可能な限りシステムコール名と引数を表示。 カラフル！ Asm -...

cve-2026-31431-mitigation

CVE-2026-31431 seccomp 缓解方案 基于 seccomp 的 CVE-2026-31431 轻量级可回退缓解方案。该漏洞是 Linux 内核 algifaead / authencesn 加密子系统中的本地提权漏洞。 通过 PAM 模块 在会话建立时加载 seccomp 过滤器，覆盖所有会话类型：su、ssh、login 等。 English 漏洞概述 类型： 本地提权 LPE 影响组件： Linux 内核 crypto/algifaead.c - in-place AEAD 操作 攻击原理： 通过 authencesn AEAD 算法的 scratch-write...

harden-docker-seccomp

harden-docker-seccomp Idempotent script to block AFALG socket creation for all Docker containers on a host as mitigation for CVE-2026-31431 "Copy Fail". Background CVE-2026-31431 is a local privilege escalation in the Linux kernel's authencesn cryptographic template, present in kernels built...

Linux Distros Unpatched Vulnerability : CVE-2026-89603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscalltraceenter for ptrace, anothe...

CVE-2026-89603

A flaw was found in the Linux kernel. A race condition exists where a seccomp filter, intended to restrict system calls, can be bypassed by an unprivileged process. This occurs when a thread is stopped for tracing ptrace and another thread attempts to apply a seccomp filter with the...

AZL-100500 CVE-2026-89603 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscalltraceenter for ptrace, another thread can install a seccomp filter with SECCOMPFILTERFLAGTSYNC e.g...

DEBIAN-CVE-2026-89603

In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscalltraceenter for ptrace, another thread can install a seccomp filter with SECCOMPFILTERFLAGTSYNC e.g...