MSRKit

MSRKit 一个通过易受攻击的驱动程序（AmdTools64.sys）中的 wrmsr 原语，利用 ROP 链来调用 内核函数和映射 驱动程序的工具。 工作原理 1. 通过 NtLoadDriver 加载 AmdTools64.sys（如果符号链接不可用，则回退到 PnP 设备节点 + 基于 GUID 的设备接口） 2. 通过驱动程序的 MSR 读取 IOCTL（0xFFF02804）读取 IA32LSTAR 3. 在 ntoskrnl.exe 中扫描 ROP gadget（pop rcx; ret、mov cr4, rcx; ret、wbinvd; ret 等） 4. 用入口...

rootkit-detection-ebpf-time-trace

eBPF時間トレースによるルートキット検出...

CVE-2025-7771

CVE-2025-7771 ThrottleStopドライバを悪用して、ユーザーモードから任意のカーネルモード関数を呼び出すエクスプロイト。 デモ 参照 https://github.com/jonomango/superfetch https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/...

xnuspy

xnuspy Output from the kernel log after compiling and running example/open1hook.c xnuspy is a pongoOS module that installs a new system call, xnuspyctl, which allows you to hook kernel functions from userspace. It supports iOS 13.x, iOS 14.x, and iOS 15.x on checkra1n 0.12.2 and up. 4K devices ar...

CVE-2026-64036

In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before cssrstatcpu access cssrstatupdated is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a...

CVE-2026-53110

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Zero-extend bpf prog return values and kfunc arguments s390x ABI requires callers to zero-extend unsigned arguments and sign-extend signed arguments, and callees to zero-extend unsigned return values and sign-extend...

EUVD-2026-38978

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Zero-extend bpf prog return values and kfunc arguments s390x ABI requires callers to zero-extend unsigned arguments and sign-extend signed arguments, and callees to zero-extend unsigned return values and sign-extend...

CVE-2026-53110

The CVE-2026-53110 entry concerns the Linux kernel s390/s390x BPF JIT: the ABI requires zero-extending unsigned arguments and return values, but the JIT historically performed only sign-extension. The connected Red Hat, Debian/Ubuntu OSV entries and the NVD description confirm the issue and its r...

CVE-2026-53095 bpf: Fix abuse of kprobe_write_ctx via freplace

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix abuse of kprobewritectx via freplace uprobe programs are allowed to modify struct ptregs. Since the actual program type of uprobe is KPROBE, it can be abused to modify struct ptregs via kprobe+freplace when the kprobe...

PT-2026-52004

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390 BPF JIT Just-In-Time compiler, which is a component that translates BPF bytecode into native machine code for faster execution. The s390x ABI Application Bina...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the srcugpstartifneeded function in tiny SRCU directly calling schedulework. This could lead to...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the kvmgetvcuplbycpuid function accepting negative cpuid parameters, potentially leading to...

LoongArch: BPF: Sign extend kfunc call arguments

...

CVE-2025-71129

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Sign extend kfunc call arguments The kfunc calls are native calls so they should follow LoongArch calling conventions. Sign extend its arguments properly to avoid kernel panic. This is done by adding a new...

CVE-2025-71129

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Sign extend kfunc call arguments The kfunc calls are native calls so they should follow LoongArch calling conventions. Sign extend its arguments properly to avoid kernel panic. This is done by adding a new...

UBUNTU-CVE-2025-71129

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Sign extend kfunc call arguments The kfunc calls are native calls so they should follow LoongArch calling conventions. Sign extend its arguments properly to avoid kernel panic. This is done by adding a new...

CVE-2025-71129

The CVE-2025-71129 entry documents a LoongArch kernel issue where kfunc calls did not sign-extend their arguments properly, risking kernel panic. The fix introduces a new emit_abi_ext() helper that performs in-place extension (distinct from sign_extend()) to ensure LoongArch calling conventions a...

CVE-2025-71129 LoongArch: BPF: Sign extend kfunc call arguments

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Sign extend kfunc call arguments The kfunc calls are native calls so they should follow LoongArch calling conventions. Sign extend its arguments properly to avoid kernel panic. This is done by adding a new...

CVE-2025-71129

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Sign extend kfunc call arguments The kfunc calls are native calls so they should follow LoongArch calling conventions. Sign extend its arguments properly to avoid kernel panic. This is done by adding a new...

The vulnerability of the blk_should_throtl() function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the blkshouldthrotl function in the Linux operating system is related to an error in pointer arithmetic. Exploiting this vulnerability can allow an attacker to cause a service failure...