eBPF-hid_guard

eBPF-hidguard 请参见下文存档原因。 一个 Linux 内核空间安全监控工具，用于检测和阻止 HID 注入攻击（Rubber Ducky、O.MG Cable、基于 ESP32 的键盘模拟器），利用 eBPF HID-BPF structops。 功能介绍 恶意 HID 设备会模拟键盘并以远超人类打字速度的速度注入按键。本工具检测到这种时序异常后，会在攻击完成前将恶意设备从内核 HID 驱动中解绑。 启动时，工具会快照当前所有已连接的 HID 设备并忽略它们——仅监控新连接的设备。支持 USB 和蓝牙 HID 设备。 分支结构 main — 可用的概念验证...

Linux Distros Unpatched Vulnerability : CVE-2026-90359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject 8 byte return values on return-reading trampoline paths btfdistillfuncproto builds the function model used for the fentry/fexit/fmodret/fsession...

DEBIAN-CVE-2026-90359

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject 8 byte return values on return-reading trampoline paths btfdistillfuncproto builds the function model used for the fentry/fexit/fmodret/fsession trampolines and structops. It has accepted a 16-byte int128 return value...

CVE-2026-90359 bpf: Reject >8 byte return values on return-reading trampoline paths

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject 8 byte return values on return-reading trampoline paths btfdistillfuncproto builds the function model used for the fentry/fexit/fmodret/fsession trampolines and structops. It has accepted a 16-byte int128 return value...

CVE-2026-90359

CVE-2026-90359 affects the Linux kernel BPF subsystem. The btf_distill_func_proto() function, which builds the function model for fentry/fexit/fmod_ret/fsession trampolines and struct_ops , has accepted 16-byte __int128 return values since the trampoline was introduced. However, the BPF trampolin...

EUVD-2026-82020

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject 8 byte return values on return-reading trampoline paths btfdistillfuncproto builds the function model used for the fentry/fexit/fmodret/fsession trampolines and structops. It has accepted a 16-byte int128 return value...

CVE-2026-90359: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject 8 byte return values on return-reading trampoline paths btfdistillfuncproto builds the function model used for the fentry/fexit/fmodret/fsession trampolines and structops. It has accepted a 16-byte int128 return value...

CVE-2026-90001 HID: bpf: serialize device reference release in struct_ops destroy path

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

SUSE CVE-2026-72112

In the Linux kernel, the following vulnerability has been resolved: iouring/bpf-ops: reject re-registration of an already-bound ops ioinstallbpf only rejects a second registration on the ctx side ctx-bpfops and sets the per-map back-pointer ops-priv unconditionally. The structops link path never...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iouring/bpf-ops: Rejection of re-registration of an already-bound ops. The ioinstallbpf function only rejects a second registration on the ctx-bpfops side and unconditionally sets the per-map back-pointer ops-priv. The structops...

Linux Distros Unpatched Vulnerability : CVE-2026-72112

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iouring/bpf-ops: reject re- registration of an already-bound ops ioinstallbpf only rejects a...

UBUNTU-CVE-2026-72112

In the Linux kernel, the following vulnerability has been resolved: iouring/bpf-ops: reject re-registration of an already-bound ops ioinstallbpf only rejects a second registration on the ctx side ctx-bpfops and sets the per-map back-pointer ops-priv unconditionally. The structops link path never...

CVE-2026-72112 io_uring/bpf-ops: reject re-registration of an already-bound ops

In the Linux kernel, the following vulnerability has been resolved: iouring/bpf-ops: reject re-registration of an already-bound ops ioinstallbpf only rejects a second registration on the ctx side ctx-bpfops and sets the per-map back-pointer ops-priv unconditionally. The structops link path never...

CVE-2024-58060

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject structops registration that uses module ptr and the module btfid is missing There is a UAF report in the bpfstructops when CONFIGMODULES=n. In particular, the report is on tcpcongestionops that has a "struct module...