container_escape_audit.sh v4.8.4 — built for the kernels Kubernetes actually runs on An update to the…
Liam R. — Freelance Penetration Tester
container_escape_audit.sh v4.8.4 — built for the kernels Kubernetes actually runs on
An update to the read-only container-escape and LPE auditor, focused on the Linux distributions you actually find under Kubernetes nodes, plus two fresh CVEs.
Node-OS coverage. The CVE engine now derives a vendor alias from /etc/os-release’s ID_LIKE, so CloudLinux, Rocky, AlmaLinux and Oracle Linux resolve to the right vendor tracker instead of returning an unhelpful “unknown”. On a CloudLinux node, the recent container escapes, ncluding the actively-exploited CVE-2026-80521 now correctly defer to the vendor advisory rather than going dark.
Kernel live-patching awareness (new check 62). KernelCare, Canonical Livepatch, kpatch and Ksplice all patch CVEs without changing uname -r, the blind spot in every version-based scanner. Check 62 detects the agent, reads the effective patch level, and flags every version-based verdict as “confirm via the live-patch tool, not uname.”
Two new CVEs:
CVE-2026-43501 “Route of Root”: IPv6 RPL segment-routing-header corruption; LPE and container escape via core_pattern. Successor to Route of Death. Public kernelCTF exploit.
CVE-2025-39964: AF_ALG concurrent-write race; container escape to host root in kernelCTF. Distinct from Copy Fail despite the shared subsystem. CVSS scored honestly (disputed 5.5–7.8; encoded at Red Hat’s 7.3).
Read-only throughout.
github.com/liamromanis101/K8s-container_escape_audit
#ContainerSecurity #Kubernetes #LinuxSecurity #DevSecOps #CVE
9 reactions · 6 comments
Topics: #devsecops, #kubernetes, #cve, #containersecurity, #linuxsecurity
Comments
Schomer: Excellent work tackling the uname -r live-patching blind spot, mate. Version-based scanners are inherently locked in a reactive race, constantly trying to map vendor point-releases, ID_LIKE aliases, or effective patch levels against a moving target. The structural reality is that whether a node is running CloudLinux, Rocky, or a live-patching agent, application-layer telemetry shouldn't be the pri
Liam R.: Schomer thanks for the feedback, much appreciated.
Schomer: Anytime, Liam. Appreciate the work you’re doing on v4.8.4—handling the uname -r live-patching blind spot and mapping ID_LIKE vendor tracks is exactly the type of low-overhead, read-only engineering the industry needs right now. We are actually diving deep into the exact underlying mechanics of these page-cache writes and AF_ALG concurrent-write vectors inside our private laboratory workspace. If y
Ben N.: great job
Liam R.: Ben Nguyen thanks Ben