kernel-hardening-checker

kernel-hardening-checker ранее kconfig-hardened-check Мотивация Существует множество опций для усиления безопасности ядра Linux. Многие из них не включены по умолчанию в основных дистрибутивах. Нам приходится включать эти опции самостоятельно, чтобы сделать наши системы более безопасными. Но нико...

ParrotSec-Linux-Hardening-Project

ParrotSec Linux - 공공 키오스크 프로젝트 제한적이고 신뢰할 수 있는 환경 설계 및 구현 강화된 커널 root@kitploit: - GrSecurity 패치 커널 - PaX 강화 - x PaXctl - x PaXTest - x PaXctld - x 강화된 커널 런타임 매개변수 root@kitploit: - x 커널 자체 보호 프로젝트 KSPP - x pti=on - 커널 페이지 테이블 격리 - x slubdebug=ZF - SLUB 경계 표시 및 무결성 검사 - x slubdebug=P - slub/slab 할당자...

CVE-2026-74570

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfsrlrealloc and ntfsrlreallocnofail...

UBUNTU-CVE-2026-74570

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfsrlrealloc and ntfsrlreallocnofail...

CVE-2026-74570

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfsrlrealloc and ntfsrlreallocnofail...

EUVD-2026-59140

In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr on it might result in a buffer overread. The same thing will happen when said string is use...

CLSA-2026-1786538556 TuxCare security update for 13 packages (3 CVEs)

TuxCare rebuilt 13 packages to address 3 CVEs. Fixed in 14.2.35-tuxcare.6...

SUSE CVE-2026-64507

In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF...

CVE-2026-64507

CVE-2026-64507 : In the Linux kernel, a hardening tied to Spectre-v2 mitigations enables an IBPB flush during BPF JIT allocation/memory reuse when BPF-JIT is in use. The change guards the IBPB enabling under CONFIG_BPF_JIT, and skips enabling if the BPF dispatcher already uses a retpoline sequenc...

CVE-2026-64507 x86/bugs: Enable IBPB flush on BPF JIT allocation

In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF...

block: Avoid mounting the bdev pseudo-filesystem in userspace

...

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

copy-success — CVE-2026-31431 Compensating Control A defensiv...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from testkho not checking the KHO enabled status, which could lead to uninitialized data structure access...

kernel: HID: core: Harden s32ton() against conversion to 0 bits

In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should...

EUVD-2025-27292

Malicious code in bioql PyPI...

UBUNTU-CVE-2022-49208

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent some integer underflows My static checker complains that: drivers/infiniband/hw/irdma/ctrl.c:3605 irdmascceqinit warn: can subtract underflow 'info-dev-hmcfpmmisc.maxceqs'? It appears that...

Exploit for Use of Externally-Controlled Format String in Fortinet Fortiproxy

CVE-2024-23113-poc CVE-2024-23113 is a vulnerability discover...

CVE-2021-23240

selinuxeditcopytfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not...

Whonix v15 - Anonymous Operating System

Whonix is an operating system focused on anonymity, privacy and security. It’s based on the Tor anonymity network, Debian GNU/Linux and security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user’s real IP. Whonix consists of two parts: One...

JShielder - Automates The Process Of Installing All The Necessary Packages To Host A Web Application And Hardening A Linux Server

JSHielder is an Open Source tool developed to help SysAdmin and developers secure there Linux Servers in which they will be deploying any web application or services. This tool automates the process of installing all the necessary packages to host a web application and Hardening a Linux server wi...