firejail

Linux namespaces and seccomp-bpf sandbox...

varmor

vArmor 是一个云原生容器沙箱系统，它借助 Linux 的 AppArmor LSM, BPF LSM 和 Seccomp 技术实现强制访问控制器（即 enforcer），从而...

CLSA-2023-1683146027 kernel: Fix of 24 CVEs

media: rc: Fix use-after-free bugs caused by enetxirqsim CVE-2023-1118 - net: mpls: fix stale pointer if allocation fails during device rename CVE-2023-26545 - net/ulp: prevent ULP without clone op from entering the LISTEN status CVE-2023-0461 - Bluetooth: L2CAP: Fix u8 overflow CVE-2022-45934 -...

Astra Linux – Vulnerability in Linux 5.10, Linux

The Linux kernel before version 5.17.2 mishandles seccomp permissions. The PTRACESEIZE code path allows attackers to bypass the intended restrictions on setting the PTSUSPENDSECCOMP flag...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Entry: Fixed seccomp bypass after ptrace with TSYNC The Sashiko review identified the following issue: If a thread is stopped during syscalltraceenter for ptrace, another thread can install a seccomp filter using...

Linux Distros Unpatched Vulnerability : CVE-2026-61711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could...

CVE-2026-90339

A flaw was found in the Linux kernel's powerpc/syscall component. This vulnerability occurs when the systemcallexception function incorrectly handles a sentinel value during syscall processing, particularly when security mechanisms like seccomp or ptrace intercept a syscall. This can lead to an...

DEBIAN-CVE-2026-95837

containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a...

CVE-2026-95837

containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a...

CVE-2026-95837

The containerd container runtime (versions 2.1.0 through 2.2.6 and 2.3.0 through 2.3.3 ) is vulnerable to a security context bypass during the CRI CreateContainer checkpoint restore process. The root cause is that the CRIU tool restores the process security state from the checkpoint data instead ...

seccomp-tools

Seccomp Tools Potentes herramientas para el análisis de seccomp. Este proyecto está orientado principalmente pero no exclusivamente al análisis de sandboxes seccomp en retos pwn de CTF. Algunas funciones son específicas de CTF, pero son igualmente útiles para analizar filtros seccomp del mundo...

Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_61887)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202661887 advisory. kernel: seccomp: passthrough uretprobe systemcall without filtering CVE-2025-21834 kernel: ip6tunnel: use skbvlaninetprepare in ip6tnlrcv CVE-2026-2300...

Rocky Linux 8.6 [CIQ] Security Update: oci-seccomp-bpf-hook Multiple Vulnerabilities (ciqsa-2026_1304)

The Rocky Linux 8.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261304 advisory. This advisory aggregates security fixes for the oci-seccomp-bpf-hook SRPM in CIQ LTS 8.6. It addresses 5 CVEs: CVE-2025-52881, CVE-2025-6032,...

Rocky Linux 8.6 [CIQ] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-debuginfo / etc (ciqsa-2026_1094)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261094 advisory. This advisory aggregates security fixes for the oci-seccomp-bpf-hook SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2024-21626. Tenable has extracted the preceding...

Rocky Linux 8.6 [CIQ] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0857)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260857 advisory. This advisory aggregates security fixes for the oci-seccomp-bpf-hook SRPM in CIQ LTS 8.6. It addresses 37 CVEs: CVE-2021-36221, CVE-2021-41190,...

Rocky Linux 8.6 [CIQ] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0122)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260122 advisory. This advisory aggregates security fixes for the oci-seccomp-bpf-hook SRPM in CIQ LTS 8.6. It addresses 33 CVEs: CVE-2018-25091, CVE-2024-34155,...

Rocky Linux 8.8 [CIQ] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0800)

The Rocky Linux 8.8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260800 advisory. This advisory aggregates security fixes for the oci-seccomp-bpf-hook SRPM in CIQ LTS 8.8. It addresses 39 CVEs: CVE-2020-10756, CVE-2021-3592,...

AlmaLinux 9.2 [TuxCare] Security Update: oci-seccomp-bpf-hook (ALMALINUX9.2:CLSA-2026:1784707996)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784707996 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

SUSE CVE-2026-92574

A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, nonewprivs, and seccomp state from the checkpoint instead ...

SUSE CVE-2026-90339

In the Linux kernel, the following vulnerability has been resolved: powerpc/syscall: Fix syscall skip handling for seccomp and ptrace After enabling GENERICENTRY on PowerPC, syscallenterfromusermode returns -1 as a sentinel to signal that seccomp or ptrace has intercepted the syscall and already...