SunnyDayBPF

SunnyDayBPF SunnyDayBPF は、Azizcan Dastan によって提案・研究された、eBPF ベースの システムコール後のユーザバッファテレメトリー欺瞞 研究手法です。 この手法は、ユーザ空間のセキュリティ、ログ、またはテレメトリーエージェントによって観測されるデータが、読み取り系システムコールが完了した後 、かつエージェントがそのデータを解析、分析、または下流のセキュリティパイプラインに転送する前に 、改ざん可能かどうかを調査します。 核となる考え方は次のとおりです。 イベントは依然として発生する。 監視エージェントは依然としてデータを読み取る。...

cve-2021-33909

CVE-2021-33909のカーネルランタイム修正 このリポジトリは、「cve-2021-33909.ko」という名前のアウトオブツリーモジュールをビルドします。 cve-2021-33909は、実行時に脆弱性のある関数をkprobeで置き換えることにより、カーネルのファイルシステム層の問題を修正します。 これは「make」でビルドでき、KDIRをカーネルのソース/ヘッダーディレクトリに設定します。 これは「insmod cve-2021-33909.ko」で直接ロードするか、 カーネルのモジュールディレクトリextra/にコピー+depmodしてから「modprobe...

CVE-2026-31431-mitigation-suite

AFALG 防御框架 一个针对 Linux AFALG（地址族算法，族 38）子系统的内核运行时防御框架。专为运行企业级 Linux 集群的安全运营中心（SOC）打造，在这些环境中，零信任必须 深入 内核，而非止步于网络边缘。 为什么 AFALG 对 SOC 至关重要 AFALG 通过套接字接口（socketAFALG, SOCKSEQPACKET, 0）将内核加密 API 暴露给用户空间。它最初是为没有 /dev/crypto 的嵌入式系统而添加的，此后却积累了不成比例的内核 CVE 份额，因为它将内核态加密代码暴露给了非特权调用者——这是一种典型的攻击面错配。 在典型的企业构建中：...

AZL-104190 CVE-2026-98076 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix use-after-free on field name/type of events with multiple probes The fields of a probe-based dynamic event kprobe, uprobe, eprobe and fprobe events are created in traceprobedefineargfields by handing the...

DEBIAN-CVE-2026-98076

In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix use-after-free on field name/type of events with multiple probes The fields of a probe-based dynamic event kprobe, uprobe, eprobe and fprobe events are created in traceprobedefineargfields by handing the...

CVE-2026-98076

In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix use-after-free on field name/type of events with multiple probes The fields of a probe-based dynamic event kprobe, uprobe, eprobe and fprobe events are created in traceprobedefineargfields by handing the...

UBUNTU-CVE-2026-98076

In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix use-after-free on field name/type of events with multiple probes The fields of a probe-based dynamic event kprobe, uprobe, eprobe and fprobe events are created in traceprobedefineargfields by handing the...

CVE-2026-98076 tracing/probes: Fix use-after-free on field name/type of events with multiple probes

In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix use-after-free on field name/type of events with multiple probes The fields of a probe-based dynamic event kprobe, uprobe, eprobe and fprobe events are created in traceprobedefineargfields by handing the...

CVE-2026-98076 tracing/probes: Fix use-after-free on field name/type of events with multiple probes

In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix use-after-free on field name/type of events with multiple probes The fields of a probe-based dynamic event kprobe, uprobe, eprobe and fprobe events are created in traceprobedefineargfields by handing the...

CVE-2026-98076

The Linux kernel is vulnerable to a use-after-free issue in the tracing/probes component. The root cause resides in traceprobe_define_arg_fields(), which stores pointers to probe argument name/type strings without copying them. When multiple probes share a dynamic event (kprobe, uprobe, eprobe, o...

EUVD-2026-86906

In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix use-after-free on field name/type of events with multiple probes The fields of a probe-based dynamic event kprobe, uprobe, eprobe and fprobe events are created in traceprobedefineargfields by handing the...

CVE-2026-98076: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix use-after-free on field name/type of events with multiple probes The fields of a probe-based dynamic event kprobe, uprobe, eprobe and fprobe events are created in traceprobedefineargfields by handing the...

Linux Distros Unpatched Vulnerability : CVE-2026-98076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing/probes: Fix use-after-free on field name/type of events with multiple probes The fields of a probe-based dynamic event kprobe, uprobe, eprobe and fprobe...

PT-2026-98739

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the tracing/probes component of the Linux kernel. The problem occurs when multiple probes are attached to a single dynamic event such as kprobe, uprobe,...

DEBIAN-CVE-2026-89902

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, dobp can reach...

CVE-2026-89902 LoongArch: Avoid preempt count underflow without probe

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, dobp can reach...

Linux Distros Unpatched Vulnerability : CVE-2026-89902

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line...

PT-2026-93543

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the LoongArch architecture where the do bp function can reach kprobe singlestep handler even when no active probe is present, because userspace can issue the same brea...

PT-2026-93629

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the within kprobe blacklist function traverses the kprobe blacklist without holding the kprobe mutex. When a module is unloaded, the kprobe remove area blacklist...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: kprobes/x86: Use copyfromkernelnofault to read from an unsafe address. Reading from an unsafe address using copyfromkernelnofault in archadjustkprobeaddr is allowed because this function is called before checking whether the...