The x86_64 path called finisher_modprobe_path_overwrite() which doesn't
exist — the real API is skeletonkey_finisher_modprobe_path() with a
callback signature. arm64 builds dodged it via the #if guard; x86_64
linker rightly choked. Same fix as tioscpgrp/vsock_uaf/nft_pipapo:
primitive-only modules return EXPLOIT_FAIL honestly per verified-vs-
claimed.
v0.9.0 release builds all 4 failed because pintheft module used mmap/
mprotect/PROT_READ/MAP_PRIVATE without including sys/mman.h. Worked on
the dev host because some indirect include pulled it in; CI's stricter
glibc/musl headers don't.
Five new modules close the 2018 gap entirely and thicken
2019 / 2020 / 2024. All five carry the full 4-format detection-rule
corpus + opsec_notes + arch_support + register helpers.
CVE-2018-14634 — mutagen_astronomy (Qualys, closes 2018)
create_elf_tables() int wrap → SUID-execve stack corruption.
CISA KEV-listed Jan 2026 despite the bug's age; legacy RHEL 7 /
CentOS 7 / Debian 8 fleets still affected. 🟡 PRIMITIVE.
arch_support: x86_64+unverified-arm64.
CVE-2019-14287 — sudo_runas_neg1 (Joe Vennix)
sudo -u#-1 → uid_t underflow → root despite (ALL,!root) blacklist.
Pure userspace logic bug; the famous Apple Information Security
finding. detect() looks for a (ALL,!root) grant in sudo -ln output;
PRECOND_FAIL when no such grant exists for the invoking user.
arch_support: any (4 -> 5 userspace 'any' modules).
CVE-2020-29661 — tioscpgrp (Jann Horn / Project Zero)
TTY TIOCSPGRP ioctl race on PTY pairs → struct pid UAF in
kmalloc-256. Affects everything through Linux 5.9.13. 🟡 PRIMITIVE
(race-driver + msg_msg groom). Public PoCs from grsecurity /
spender + Maxime Peterlin.
CVE-2024-50264 — vsock_uaf (a13xp0p0v / Pwnie Award 2025 winner)
AF_VSOCK connect-race UAF in kmalloc-96. Pwn2Own 2024 + Pwnie
2025 winner. Reachable as plain unprivileged user (no userns
required — unusual). Two public exploit paths: @v4bel+@qwerty
kernelCTF (BPF JIT spray + SLUBStick) and Alexander Popov / PT
SWARM (msg_msg). 🟡 PRIMITIVE.
CVE-2024-26581 — nft_pipapo (Notselwyn II, 'Flipping Pages')
nft_set_pipapo destroy-race UAF. Sibling to nf_tables
(CVE-2024-1086) from the same Notselwyn paper. Distinct bug in
the pipapo set substrate. Same family signature. 🟡 PRIMITIVE.
Plumbing changes:
core/registry.h + registry_all.c — 5 new register declarations
+ calls.
Makefile — 5 new MUT/SRN/TIO/VSK/PIP module groups in MODULE_OBJS.
tests/test_detect.c — 7 new test rows covering the new modules
(above-fix OK, predates-the-bug OK, sudo-no-grant PRECOND_FAIL).
tools/verify-vm/targets.yaml — verifier entries for all 5 with
honest 'expect_detect' values based on what Vagrant boxes can
realistically reach (mutagen_astronomy gets OK on stock 18.04
since 4.15.0-213 is post-fix; sudo_runas_neg1 gets PRECOND_FAIL
because no (ALL,!root) grant on default vagrant user; tioscpgrp
+ nft_pipapo VULNERABLE with kernel pins; vsock_uaf flagged
manual because vsock module rarely available on CI runners).
tools/refresh-cve-metadata.py — added curl fallback for the CISA
KEV CSV fetch (urlopen times out intermittently against CISA's
HTTP/2 endpoint).
Corpus growth across v0.8.0 + v0.9.0:
v0.7.1 v0.8.0 v0.9.0
Modules 31 34 39
Distinct CVEs 26 29 34
KEV-listed 10 10 11 (mutagen_astronomy)
arch 'any' 4 6 7 (sudo_runas_neg1)
Years 2016-2026: 10/11 10/11 **11/11**
Year-by-year coverage:
2016: 1 2017: 1 2018: 1 2019: 2 2020: 2
2021: 5 2022: 5 2023: 8 2024: 3 2025: 2 2026: 4
CVE-2018 gap → CLOSED. Every year from 2016 through 2026 now has
at least one module.
Surfaces updated:
- README.md: badge → 22 VM-verified / 34, Status section refreshed
- docs/index.html: hero eyebrow + footer → v0.9.0, hero tagline
'every year 2016 → 2026', stats chips → 39 / 22 / 11 / 151
- docs/RELEASE_NOTES.md: v0.9.0 entry added on top with year
coverage matrix + per-module breakdown; v0.8.0 + v0.7.1 entries
preserved below
- docs/og.svg + og.png: regenerated with new numbers + 'Every
year 2016 → 2026' tagline
CVE metadata refresh (tools/refresh-cve-metadata.py) deferred to
follow-up — CISA KEV CSV + NVD CVE API were timing out during the
v0.9.0 push window. The 5 new CVEs will return NULL from
cve_metadata_lookup() until the refresh runs (—module-info simply
skips the WEAKNESS/THREAT INTEL header for them; no functional
impact). Re-run 'tools/refresh-cve-metadata.py' when network
cooperates.
Tests: macOS local 33/33 kernel_range pass; detect-test stubs (88
total) build clean; ASan/UBSan + clang-tidy CI jobs still green
from the v0.7.x setup.
leviathan