Zero-downtime Linux kernel zero-day mitigation via eBPF and SECCOMP

This project presents a practical, zero-downtime defense-in-depth framework to mitigate active Linux kernel zero-days without rebooting hosts. It targets three high‑severity CVEs (CVE-2026-53266 ebtables overflow, CVE-2025-39964 AF_ALG crypto netlink truncation, CVE-2025-39682 kTLS zero-length record flaw) and combines layered controls across userspace, kernel loader, and runtime monitoring. Prevention is achieved by evicting vulnerable kernel modules (example: unloading ebtables) and sealing the loader via /etc/modprobe.d overrides so modules cannot be reloaded. Containment uses container user namespace remapping (containerd v2.2.4 hostUsers:false) to map container root into an unprivileged host UID range. Detection and gating rely on modern CO-RE eBPF tracepoints (sys_enter_socket filtering domain==38 for AF_ALG; sys_enter_setsockopt filtering TCP_ULP/SOL_TLS) plus optional SECCOMP rules to block risky syscalls, enabling live interception of exploit probes without patching the kernel image.

Operational delivery includes a reactive security pipeline and automated remediation: eBPF emits alerts to an on-host Falco daemon and Falcosidekick, a forwarder broadcasts to a NATS security bus, and remediation actors (CrowdSec/nftables) can dynamically block offenders while an audit daemon appends tamper-evident SHA-256 chained records replicated to an independent attestation node. Empirical testing shows sub‑millisecond eBPF evaluation and end-to-ledger sealing within tens of milliseconds. The repository contains deployable artifacts - modprobe blacklist, Falco CO-RE rules, Kubernetes pod manifests for userns hardening, and scripts for eviction, telemetry archiving, and audit verification - ready for immediate use.