ayaFlow

ayaFlow ayaFlow ist ein Netzwerkverkehrsanalysator in Rust + eBPF, erstellt mit Aya. Es führt einen Agenten pro Linux-Knoten aus, bindet einen TC-Klassifikator am Eingang und Ausgang und stellt Live-Verkehrsdaten, historische, SQLite-gestützte Verläufe und Prometheus-Metriken zur Verfügung. Was e...

cicd-sensor

🚧 Pre-release: Active development. cicd-sensor is currently in pre-release and under active development. Feedback is very welcome. cicd-sensor Think EDR, but for CI/CD Pipelines. Open-source eBPF-powered runtime security sensor for GitHub Actions and GitLab CI/CD. → Full documentation Demo ---...

guardd

guardd Maschinell lernbasierte Verhaltensanomalieerkennung für Linux mit eBPF + Isolation Forest Guardd sammelt systemnahe Ereignisse Prozessausführung, Netzwerkaktivität, aggregiert sie zu zeitfensterbasierten Merkmalsvektoren und erkennt anomales Verhalten mittels eines maschinellen Lernmodells...

container-escape-ebpf

Libro bianco https://www.scs-europe.net/dlib/2026/2026-0321.html Assunzioni L'host esegue una versione vulnerabile di runc: Per CVE-2025-31133: 1.2.7 e precedenti, 1.3.0-rc.1 fino a 1.3.2, 1.4.0-rc.1 e 1.4.0-rc.2. Per CVE-2024-21626: 1.0.0-rc93 fino a 1.1.11. Un utente non privilegiato è in grado...

CVE-2026-7878-eBPF-Verifier-Type-Confusion-Kernel-Memory-Read-Write

6. CVE-2026-7878 – Confusion de type dans le vérificateur eBPF → Lecture/écriture mémoire noyau Vue d'ensemble Un débordement d'entier subtil dans le suivi des bornes du vérificateur eBPF permet à un attaquant de créer un programme eBPF qui accède à de la mémoire noyau hors limites. Sévérité :...

cve-2021-3490-ebpf-analysis

cve-2021-3490-ebpf-analysis Forschungsumsetzung, die die Interaktion mit dem Linux-eBPF-Subsystem im Zusammenhang mit CVE-2021-3490 demonstriert. Enthält BPF-Map-Erstellung, Syscall-Wrapper, Namespace-Einrichtung und Verifier-Analyse. Nur für Bildungs- und Sicherheitsforschungszwecke. CVE-2021-34...

kestrel

Die Sichtbarkeit auf Kernel-Ebene von Falco, mit der Live-Oberfläche, die kernel-native Werkzeuge nicht mitbringen. Schnellstart · Spezifikation · Ansichten · Roadmap Kestrel verfolgt Kernel-Ereignisse Prozess-Exec, Dateizugriff, Netzwerkverbindungen mit einem eBPF -Agenten und streamt sie an ein...

blackpill

BlackPill BlackPill ist ein heimliches Linux-Rootkit, geschrieben in Rust. Funktionen Das Rootkit besteht aus mehreren Modulen gemeint sind Rust-Module, keine Kernel-Module: Defense Evasion : Verstecken von Dateien, Prozessen, Netzwerkverbindungen usw. Hooking : Hooking von Syscalls und IDT...

CVE-2026-72232

A flaw was found in the batman-adv component of the Linux kernel. A local user with extended Berkeley Packet Filter eBPF traffic control TC hook access could exploit this by attaching a TC filter that truncates a packet and redirects it to a batman-adv interface. The batadvinterfacetx function th...

GO-2026-6238 Integer overflow in BTF parsing in github.com/cilium/ebpf

Integer overflow in BTF parsing in github.com/cilium/ebpf...

Linux Distros Unpatched Vulnerability : CVE-2026-74305

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 bpf: Fix oob access in cgroup local storage is still incomplete. The...

Linux Distros Unpatched Vulnerability : CVE-2026-72232

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 net: bridge: xmit: make sure we have at least eth header len bytes, it is...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-090701)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090701 advisory. A flaw was found in unrestricted eBPF usage by the BPFBTFLOAD, leading to a possible out-of-bounds memory write in the Linux kernels BPF subsystem due to the way a...

CVE-2026-74364

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map created with exclproghash is bound to a single program by hash: checkmapprogcompatibility refuses to load any program whose digest does not match...

UBUNTU-CVE-2026-74305

In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 "bpf: Fix oob access in cgroup local storage" is still incomplete. The prog-array compatibility check treats a program with no cgroup storag...

CVE-2026-72232

In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 "net: bridge: xmit: make sure we have at least eth header len bytes", it is possible by for a local user with eBPF TC hook access to attach a t...

UBUNTU-CVE-2026-72232

In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 "net: bridge: xmit: make sure we have at least eth header len bytes", it is possible by for a local user with eBPF TC hook access to attach a t...

CVE-2026-72232

In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 "net: bridge: xmit: make sure we have at least eth header len bytes", it is possible by for a local user with eBPF TC hook access to attach a t...

CVE-2026-74314 bpf: Cancel special fields on map value recycle

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpfobjfreefields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...

CVE-2026-72427 bpf: Fix effective prog array index with BPF_F_PREORDER

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix effective prog array index with BPFFPREORDER replaceeffectiveprog and purgeeffectiveprogs located the slot in the effective array by walking the program hlist and counting entries linearly. That count does not match the...