mquire

mquire mquire，由 memory 和 inquire 组合而成，是一款受 osquery 启发而开发的内存查询工具。 核心优势：无需外部调试符号 mquire 可以在不需要外部调试符号的情况下分析 Linux 内核内存快照。 分析所需的一切都已嵌入内存转储本身。这意味着你可以分析： 从未见过的未知或定制内核 无需准备的任何 Linux 发行版 外部调试符号不可用或丢失的内存快照 要求 内核版本要求 ： BTF 支持 ：内核 4.18 或更新版本，并启用了 BTF（大多数现代发行版默认启用） Kallsyms 支持 ：内核 6.4 或更新版本（由于...

krie

KRIe KRIe 是一个研究项目，旨在通过 eBPF 检测 Linux 内核漏洞利用。KRIe 远非万无一失的策略：从 eBPF 相关的限制到可能依赖被攻破内核来发出安全事件的后利用检测，显然，一个动机明确的攻击者最终能够绕过它。 尽管如此，该项目的目标是让攻击者的日子更难过，并最终阻止现成的漏洞利用在易受攻击的内核上生效。 KRIe 使用 CO-RE（一次编译，到处运行） 开发，因此兼容大量内核版本。如果你的内核未导出 BTF 调试信息，KRIe 将尝试从 BTFHub 自动下载。如果你的内核在 BTFHub 上不可用，但你已经能够手动生成内核的 BTF...

cve-2024-23113-poc

CVE-2024-23113-poc CVE-2024-23113 es una vulnerabilidad descubierta en el Linux Kernel , clasificada como vulnerabilidad de ejecución de código arbitrario , que afecta al subsistema bpf Berkeley Packet Filter. Específicamente, esta vulnerabilidad afecta a los objetos de tipo bpfprog de los...

CVE-2026-98065

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A local user can cause a Denial of Service DoS by creating a hash map lacking key type information and reading it through the BPF file system. Due to missing validation of BPF Type Format BTF metadata, the kernel attempt...

CVE-2026-98064

A flaw was found in the Linux kernel. A local user can cause a Denial of Service DoS and crash the system by running a specially crafted BPF Berkeley Packet Filter program. The issue occurs within the BPF Type Format BTF component when attempting to display data referencing a void data type, whic...

CVE-2026-98063

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. When formatting data using BPF Type Format BTF, the kernel attempts to access type identifiers without checking if they are initialized. A local user with permissions to execute BPF programs can exploit this vulnerabilit...

AZL-104492 CVE-2026-98063 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref in btfvarshow btfvarshow calls btftypeidresolve unconditionally, which dereferences btf-resolvedids. That is NULL for a base BTF - e.g. the vmlinux BTF that bpfsnprintfbtf renders against - since base BTF ...

CVE-2026-98065

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...

CVE-2026-98065

The Linux kernel contains a vulnerability where key-less BTF (Type ID 0) can be created for hash maps (htab and rhtab ). This occurs because these maps gained a ->map_check_btf callback that fails to validate the key, allowing the creation of maps that were previously rejected. When reading th...

CVE-2026-98065 bpf: Reject key-less BTF for hash maps

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...

EUVD-2026-86718

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...

EUVD-2026-86717

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref when showing a void BTF type btfmodifiershow resolves the modifier and then calls btftypeopst-show unconditionally. For the void type typeid 0, BTFKINDUNKN kindops has no entry, so -show is NULL. A "const...

CVE-2026-98064

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref when showing a void BTF type btfmodifiershow resolves the modifier and then calls btftypeopst-show unconditionally. For the void type typeid 0, BTFKINDUNKN kindops has no entry, so -show is NULL. A "const...

CVE-2026-98065

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...

PT-2026-98728

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the map check btf function allows the creation of hash maps with a key-less BTF BPF Type Format, specifically when btf k...

PT-2026-98727

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the BPF subsystem when processing a void BTF type. The function btf modifier show resolves a modifier and unconditionally calls btf type opst-show...

PT-2026-98726

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the btf var show function. This occurs because the function calls btf type id resolve unconditionally, which attempts to dereference btf-resolved ids...

Linux Distros Unpatched Vulnerability : CVE-2026-98063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix NULL-ptr-deref in btfvarshow btfvarshow calls btftypeidresolve unconditionally, which dereferences btf-resolvedids. That is NULL for a base BTF - e.g...

PT-2026-98709

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the bpf btf find by name kind function is not correctly marked as sleepable. When this function finds a type in module BTF, it calls btf new fd...

SUSE CVE-2026-92515

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve unique-field state across nested structs btffindstructfield initializes a fresh seen mask for every recursive descent. Unique special fields in different levels of the same aggregate therefore do not see one another...