Linux kernel crash correlated with unshare/PoC binary precursor

Arnold Chan@slaz

•updated Sep 19, 2026•0•0•0

This rule detects Linux kernel crashes or faults (e.g., kernel BUG, panic, use-after-free, slab-out-of-bounds) that occur shortly after the execution of suspicious utilities or processes known to be associated with kernel exploitation or container escape attempts (e.g., unshare, dirtyah6, tunderflow). By correlating crash logs with preceding process execution, it identifies potential post-exploitation activity or exploit testing.