Issues

• [RCU Leak] 查询不存在的 KPM 时直接返回，未释放 rcu_read_lock()

  Zhanfg/KernelPatch-Public#15 · Filter by author Zhanfg opened on Aug 7, 2026
  2

• [Safety Logic] 同一 module_init() 连续递增两次启动计数，KPM crash protection 阈值与持久化模型不成立

  Zhanfg/KernelPatch-Public#14 · Filter by author Zhanfg opened on Aug 7, 2026
  1

• [P0][ELF Parser] 未验证 e_shstrndx、sh_name 与 sh_link 边界，恶意 KPM 可触发内核越界读写

  Zhanfg/KernelPatch-Public#13 · Filter by author Zhanfg opened on Aug 7, 2026
  1

• [P0][Kernel Crash] KPM 只含 init 或只含 exit 时仍通过检查，随后无条件调用空函数指针

  Zhanfg/KernelPatch-Public#12 · Filter by author Zhanfg opened on Aug 7, 2026
  2

• [P0][Cred Integrity] SU_TASK 原地改写任意任务共享 cred 与 seccomp 字段，违反内核凭据不可变模型

  Zhanfg/KernelPatch-Public#11 · Filter by author Zhanfg opened on Aug 7, 2026
  1

• [P0][UAF] KPM 列表使用 RCU 读取却无写锁并立即释放模块代码，并发 control/unload 可执行已释放内存

  Zhanfg/KernelPatch-Public#10 · Filter by author Zhanfg opened on Aug 7, 2026
  1

• [User Pointer] SKEY_SET 校验内核副本后却再次读取原始用户指针，存在 TOCTOU 与内核故障窗口

  Zhanfg/KernelPatch-Public#9 · Filter by author Zhanfg opened on Aug 7, 2026
  2

• [P0][Info Leak] SUPERCALL_KPM_LIST 按用户 len 越界复制 4 KiB 栈缓冲区

  Zhanfg/KernelPatch-Public#8 · Filter by author Zhanfg opened on Aug 7, 2026
  2

• [Auth] superkey 校验不比较长度，正确密钥加任意后缀仍会通过认证

  Zhanfg/KernelPatch-Public#7 · Filter by author Zhanfg opened on Aug 7, 2026
  2

• [P0][AuthZ] 已授权 UID 无需超级密钥即可授权其他 UID、关闭安全模式并改写全局隐藏策略

  Zhanfg/KernelPatch-Public#6 · Filter by author Zhanfg opened on Aug 7, 2026
  2