From GitHub · · 3m
Zero-Downtime Linux Kernel Zero-Day Defense
How to block active kernel zero-days without reboots.
In brief
How to block active kernel zero-days without reboots. A zero-downtime defense framework mitigates three Linux kernel vulnerabilities using eBPF telemetry, module disarmament, and user namespaces without host reboots. Originally reported by GitHub.
CISA Adds Critical Vulnerabilities to KEV Catalog
When the Cybersecurity and Infrastructure Security Agency (CISA) adds critical Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, an urgent operational clock starts ticking for infrastructure teams and SRE leads.
Upstream Patch Gap
The duration between public weaponization of an in-the-wild zero-day and availability of tested, signed binary kernel packages from major enterprise distributions typically spans 7 to 21 days.
Production Kubernetes Risk
In production Kubernetes clusters, passively awaiting vendor packages exposes systems to active exploitation, while premature kernel upgrades or emergency reboots risk operational outages.
Case Study Framework
This case study documents a defense-in-depth compensating control framework designed to manage three concurrent Linux kernel vulnerabilities (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682) across userspace, the kernel loader, and runtime layers without requiring host reboots.
Automated Framework Announcement
Looking for an automated, zero-dependency CLI that audits attack surfaces, disarms dormant modules with 60-second watchdog rollbacks, and provides cross-node dual-witness WORM attestation? See the companion framework: kshield (Project Aegis-Kernel).
Threat Matrix & Defense Taxonomy
To ensure operational accuracy, defenses are categorized strictly by their security properties: Prevention, Runtime Detection, and Containment.
CVE-2026-53266 Defense
For CVE-2026-53266 (Netfilter Bridging), the defense uses RAM eviction (modprobe -r) and loader override (/bin/true) to prevent arithmetic overflow in bridge ARP table rewrite rules.
CVE-2025-39964 Defense
For CVE-2025-39964 (Crypto Netlink), the defense uses modern eBPF (sys_enter_socket, domain 38) and SECCOMP to detect integer truncation in netlink crypto socket allocation.
CVE-2025-39682 Defense
For CVE-2025-39682 (Kernel TLS), the defense uses modern eBPF (sys_enter_setsockopt, TCP_ULP 31 & SOL_TLS 282) to detect zero-length record processing flaws in TCP ULP.
Layered Defense Architecture
The architecture includes user space, kernel, eBPF engine, user namespaces, and reactive event pipelines for zero-downtime kernel zero-day defense.
Kernel Module Disarmament
Active memory eviction requires two steps: unload resident modules with modprobe -r and configure /bin/true loader overrides to prevent reloading.
eBPF Syscall Telemetry
Synchronous gating via SECCOMP blocks AF_ALG sockets within 1 microsecond, while eBPF detects and triggers incident reflexes for kTLS activation.
User Namespace Isolation
Container root (UID 0) is remapped to host UID 1000000 in containerd v2.2.4 with Kubernetes CRI v1.30 (hostUsers: false) to bound privilege escalation.
Cryptographically Tamper-Evident Audit
The audit ledger uses SHA-256 chaining and cross-node replication to prevent log tampering and ensure tamper-evident forensics.
Empirical Verification
Synthetic AF_ALG socket allocation tests confirmed zero false positives and 386,213 verified records with no tampering detected.
Production Deployment
The repository includes production-ready configurations for immediate deployment: modprobe overrides, Falco eBPF rules, and user namespace manifests.
The short version
A zero-downtime defense framework mitigates three Linux kernel vulnerabilities using eBPF telemetry, module disarmament, and user namespaces without host reboots.
