cve-2026-99999-scanner

 #!/usr/bin/env bash
 # =============================================================================
 #  scanner-cve-2026-99999.sh  (English output · Korean edition: scanner-cve-2026-99999_kr.sh)
 #  CVE-2026-99999 "PwnEscape" — Linux kernel exposure check and patch guidance
 # -----------------------------------------------------------------------------
 #  Component : kernel IPv4 stack (skb_checksum_help → ip_do_fragment)
 #  Cause     : checksum_start/csum_offset supplied through the virtio-net header or
 #              packet sockets is not validated against the IPv4 header, so completing
 #              the checksum can overwrite an already-validated header (IHL) (CWE-20)
 #  Impact    : guest VM → host memory disclosure · host crash · root code execution on host
 #  Score     : CVSS 3.1 9.3 Critical (kernel CNA) / 8.8 Important (Red Hat)
 #  Introduced: Linux 2.6.27 (f43798c27684)
 #  Fixed by  : 6785011f8b16 "ipv4: validate checksum_start before completing checksum"
 #  Workaround: none published — boot a fixed kernel
 #
 #  Verdicts use vendor advisories as of 2026-10-20. Fixes released later are picked up
 #  by searching the installed kernel package changelog for the CVE / fix commit.
 #
 #  Usage     : bash scanner-cve-2026-99999.sh [-l] [--no-color] [...]   (see -h)
 #              Menu after the verdict: 1) patch now (update kernel → reboot)
 #                                      2) patch manually later (print commands)  3) exit
 #              When not run from a terminal (cron, pipes) it behaves like option 2
 #  Exit codes: 0 safe / 1 vulnerable (fix available) / 2 fixed kernel installed, reboot needed
 #              3 vulnerable (no vendor fix yet or end of life) / 4 undetermined
 # =============================================================================
 
 # If started with sh/dash, re-run under bash when available (uses bash features such as read -t)
 if [ -z "${BASH_VERSION:-}" ] && [ -f "$0" ] && command -v bash >/dev/null 2>&1; then
   exec bash "$0" "$@"
 fi
 
 set -u
 
 CVE="CVE-2026-99999"
 FIX_TITLE="ipv4: validate checksum_start before completing checksum"
 FIX_COMMIT="6785011f8b16"
 FIX_URL="https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822"
 DATA_DATE="2026-10-20"
 # Changelog entries written before this year cannot contain the fix (CVE reserved 2026-09,
 # fix committed 2026-10). Changelogs list the newest entry first, so reading stops there.
 CHANGELOG_CUTOFF_YEAR=2026
 
 # First fixed release per upstream stable branch (kernel CNA, 2026-10-15). Mainline: 7.3-rc7.
 UPSTREAM_FIXED="5.10.272 5.15.223 6.1.190 6.6.159 6.12.113 6.18.57 7.2.11"
 UPSTREAM_TEXT="5.10.272 · 5.15.223 · 6.1.190 · 6.6.159 · 6.12.113 · 6.18.57 · 7.2.11 · 7.3-rc7 or later"
 
 OS_RELEASE_FILE=/etc/os-release
 OSR_GIVEN=0
 KREL=""
 KVER=""
 OFFLINE=0
 USE_COLOR=1
 LIST_ONLY=0
 SUDO=""
 OS_MAJ_NUM=0
 # Define global state up front so every code path is safe under set -u
 RUN_DVER=""; VIRT=""; CTR=""; HV_HOST=0; FINAL=""; R_MODE=""; R_PKG=""; R_ADV=""; R_FIXED=""
 REBOOT_TARGET=""; REBOOT_KREL=""; NB_ALT=""; NEXT_WARN=""; LP_NAME=""; E_INPLACE=0
 
 # -----------------------------------------------------------------------------
 # Fixed kernels per vendor
 #   Format: branch|version-release to compare (no dist tag)|fixed package|advisory|package name
 # -----------------------------------------------------------------------------
 vendor_table() {
   case $1 in
     alma8)  echo '4.18|4.18.0-553.174.2|kernel-4.18.0-553.174.2.el8_10|AlmaLinux advisory 2026-10-16, testing repo|kernel' ;;
     alma9)  echo '5.14|5.14.0-687.57.2|kernel-5.14.0-687.57.2.el9_8|AlmaLinux advisory 2026-10-16, testing repo|kernel' ;;
     alma10) echo '6.12|6.12.0-211.66.2|kernel-6.12.0-211.66.2.el10_2|AlmaLinux advisory 2026-10-16, testing repo|kernel' ;;
     uek)
       cat <<'EOF'
 5.4|5.4.17-2136.360.3.1|kernel-uek-5.4.17-2136.360.3.1 (UEK R6, OL7/8)|ELSA-2026-500397|kernel-uek
 5.15|5.15.0-325.221.6.4|kernel-uek-5.15.0-325.221.6.4 (UEK R7, OL8/9)|ELSA-2026-500398|kernel-uek
 6.12|6.12.0-207.111.5.4|kernel-uek-6.12.0-207.111.5.4 (UEK R8, OL9/10)|ELSA-2026-500399|kernel-uek
 EOF
       ;;
     al2)
       cat <<'EOF'
 4.14|4.14.355-287.753|kernel-4.14.355-287.753.amzn2|ALAS2-2026-3962|kernel
 5.4|5.4.302-229.498|kernel-5.4.302-229.498.amzn2|ALAS2KERNEL-5.4-2026-131|kernel
 5.10|5.10.269-270.1108|kernel-5.10.269-270.1108.amzn2|ALAS2KERNEL-5.10-2026-133|kernel
 5.15|5.15.221-157.262|kernel-5.15.221-157.262.amzn2|ALAS2KERNEL-5.15-2026-117|kernel
 EOF
       ;;
     al2023)
       cat <<'EOF'
 6.1|6.1.188-233.385|kernel-6.1.188-233.385.amzn2023|ALAS2023-2026-3197|kernel
 6.12|6.12.110-135.201|kernel6.12-6.12.110-135.201.amzn2023|ALAS2023-2026-3196|kernel6.12
 6.18|6.18.54-121.166|kernel6.18-6.18.54-121.166.amzn2023|ALAS2023-2026-3192|kernel6.18
 EOF
       ;;
   esac
 }
 
 # -----------------------------------------------------------------------------
 # Output helpers
 # -----------------------------------------------------------------------------
 setup_colors() {
   local e
   if [ "$USE_COLOR" = 1 ] && [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then
     e=$(printf '\033')
     C_RED="$e[1;31m"; C_GRN="$e[1;32m"; C_YEL="$e[1;33m"
     C_BLU="$e[1;36m"; C_DIM="$e[2m";    C_OFF="$e[0m"
   else
     C_RED=; C_GRN=; C_YEL=; C_BLU=; C_DIM=; C_OFF=
   fi
 }
 section() { printf '\n%s■ %s%s\n' "$C_BLU" "$1" "$C_OFF"; }
 kv()      { printf '  %s: %s\n' "$1" "$2"; }
 line()    { printf '  %s\n' "$*"; }
 note()    { printf '  %s* %s%s\n' "$C_DIM" "$*" "$C_OFF"; }
 cmd()     { printf '    %s%s%s\n' "$C_GRN" "$*" "$C_OFF"; }
 cmt()     { printf '    %s# %s%s\n' "$C_DIM" "$*" "$C_OFF"; }
 die()     { printf 'Error: %s\n' "$*" >&2; exit 4; }
 
 # Look a command up in PATH once and cache the result
 have() {
   local v="HAVE_${1//[!A-Za-z0-9]/_}"
   eval "case \${$v-} in 1) return 0 ;; 0) return 1 ;; esac"
   if command -v "$1" >/dev/null 2>&1; then eval "$v=1"; return 0; fi
   eval "$v=0"; return 1
 }
 
 # True if stdin (a newest-first changelog) records the fix.
 #  - the CVE id (not adjacent to other letters/digits) or the "ipv4: validate checksum_start ..." title
 #  - lines containing "revert" never count as the fix
 #  - stops at the first entry date (rpm "* Mon Oct 13 2026 ..." / deb " -- Name  Mon, 13 Oct 2026 ...")
 #    older than CHANGELOG_CUTOFF_YEAR → only the recent part of a multi-MB changelog is read
 #  It exits as soon as it matches or stops, so the upstream rpm/gzip also stops (SIGPIPE).
 has_fix_text() {
   LC_ALL=C awk -v cve="$CVE" -v title="$FIX_TITLE" -v cutoff="$CHANGELOG_CUTOFF_YEAR" '
     BEGIN { cve = tolower(cve); title = tolower(title); found = 0 }
     {
       l = tolower($0)
       if ((substr(l, 1, 2) == "* " || substr(l, 1, 4) == " -- ") &&
           match(l, / (19|20)[0-9][0-9]( |$)/)) {
         if (substr(l, RSTART + 1, 4) + 0 < cutoff) exit
       }
       if (index(l, "revert")) next
       p = index(l, cve)
       if (p) {
         a = (p > 1) ? substr(l, p - 1, 1) : ""
         b = substr(l, p + length(cve), 1)
         if (a !~ /[0-9a-z]/ && b !~ /[0-9a-z]/) { found = 1; exit }
       }
       if (index(l, title)) { found = 1; exit }
     }
     END { exit found ? 0 : 1 }'
 }
 
 usage() {
   cat <<EOF
 Usage: $0 [options]
 
 Checks this system's distribution and running kernel for $CVE (PwnEscape).
 If it is vulnerable, choose one of:
 
   1. Patch now               update the kernel with the distro package manager and reboot
   2. Patch manually later    only print the commands to run
   3. Exit
 
 Checking works as a regular user. Option 1 needs root and uses sudo.
 When not run from a terminal (cron, pipes) no menu is shown; it prints the commands like option 2.
 
 Options:
   -l, --list              print only the per-distribution fixed-version table
       --no-color          disable colored output
       --os-release FILE   use this os-release file (default: /etc/os-release)
       --uname-r STRING    kernel release to judge (e.g. 'uname -r' from another server)
       --uname-v STRING    kernel build string ('uname -v', used for Debian)
   -h, --help              show this help
 
   With --uname-r, local checks of this system (changelog, installed kernels,
   livepatch, virtualization host) are skipped.
 
 Exit codes:
   0 safe   1 vulnerable (fix available)   2 fixed kernel installed, reboot needed
   3 vulnerable (no vendor fix yet or end of life)   4 undetermined
 EOF
 }
 
 parse_args() {
   while [ $# -gt 0 ]; do
     case $1 in
       -l|--list)    LIST_ONLY=1 ;;
       --no-color)   USE_COLOR=0 ;;
       --os-release) [ $# -ge 2 ] || die "--os-release requires a file path"
                     OS_RELEASE_FILE=$2; OSR_GIVEN=1; shift
                     [ -r "$OS_RELEASE_FILE" ] || die "cannot read os-release file: $OS_RELEASE_FILE" ;;
       --uname-r)    [ $# -ge 2 ] || die "--uname-r requires a value"; KREL=$2; OFFLINE=1; shift ;;
       --uname-v)    [ $# -ge 2 ] || die "--uname-v requires a value"; KVER=$2; shift ;;
       -h|--help)    usage; exit 0 ;;
       *)            usage >&2; exit 4 ;;
     esac
     shift
   done
   # Mixing the real kernel release with a supplied build string would skew the verdict
   if [ -n "$KVER" ] && [ "$OFFLINE" = 0 ]; then
     die "--uname-v must be used together with --uname-r"
   fi
 }
 
 # -----------------------------------------------------------------------------
 # Version comparison (rpm: rpmvercmp, deb: dpkg rules). deb uses dpkg when available.
 # -----------------------------------------------------------------------------
 AWK_VERCMP='
 function numcmp(x, y) {
   sub(/^0+/, "", x); sub(/^0+/, "", y)
   if (length(x) != length(y)) return (length(x) < length(y)) ? -1 : 1
   if (x == y) return 0
   return (x < y) ? -1 : 1
 }
 function splitvr(s,   i) {
   V = s; R = ""
   for (i = length(s); i > 0; i--)
     if (substr(s, i, 1) == "-") { V = substr(s, 1, i - 1); R = substr(s, i + 1); return }
 }
 function epoch(s) {
   E = 0; S = s
   if (match(s, /^[0-9]+:/)) { E = substr(s, 1, RLENGTH - 1); S = substr(s, RLENGTH + 1) }
 }
 function rpmvercmp(a, b,   sa, sb, r) {
   if (a == b) return 0
   while (a != "" || b != "") {
     sub(/^[^A-Za-z0-9~^]+/, "", a); sub(/^[^A-Za-z0-9~^]+/, "", b)
     if (substr(a, 1, 1) == "~" || substr(b, 1, 1) == "~") {
       if (substr(a, 1, 1) != "~") return 1
       if (substr(b, 1, 1) != "~") return -1
       a = substr(a, 2); b = substr(b, 2); continue
     }
     if (substr(a, 1, 1) == "^" || substr(b, 1, 1) == "^") {
       if (a == "") return -1
       if (b == "") return 1
       if (substr(a, 1, 1) != "^") return 1
       if (substr(b, 1, 1) != "^") return -1
       a = substr(a, 2); b = substr(b, 2); continue
     }
     if (a == "" || b == "") break
     if (substr(a, 1, 1) ~ /[0-9]/) {
       match(a, /^[0-9]+/); sa = substr(a, 1, RLENGTH); a = substr(a, RLENGTH + 1)
       if (!match(b, /^[0-9]+/)) return 1
       sb = substr(b, 1, RLENGTH); b = substr(b, RLENGTH + 1)
       r = numcmp(sa, sb)
     } else {
       match(a, /^[A-Za-z]+/); sa = substr(a, 1, RLENGTH); a = substr(a, RLENGTH + 1)
       if (!match(b, /^[A-Za-z]+/)) return -1
       sb = substr(b, 1, RLENGTH); b = substr(b, RLENGTH + 1)
       r = (sa < sb) ? -1 : (sa > sb) ? 1 : 0
     }
     if (r) return r
   }
   if (a == "" && b == "") return 0
   return (a == "") ? -1 : 1
 }
 function rpmevr(a, b,   ea, eb, va, vb, ra, rb, r) {
   epoch(a); ea = E; a = S
   epoch(b); eb = E; b = S
   r = numcmp(ea, eb); if (r) return r
   splitvr(a); va = V; ra = R
   splitvr(b); vb = V; rb = R
   r = rpmvercmp(va, vb); if (r) return r
   return rpmvercmp(ra, rb)
 }
 function dorder(c) {
   if (c == "") return 0
   if (c == "~") return -1
   if (c ~ /[A-Za-z]/) return index(ASCII, c) + 31
   return index(ASCII, c) + 31 + 256
 }
 function dvercmp(a, b,   ca, cb, oa, ob, da, db, r) {
   while (a != "" || b != "") {
     while ((a != "" && substr(a, 1, 1) !~ /[0-9]/) || (b != "" && substr(b, 1, 1) !~ /[0-9]/)) {
       ca = substr(a, 1, 1); if (ca ~ /[0-9]/) ca = ""
       cb = substr(b, 1, 1); if (cb ~ /[0-9]/) cb = ""
       oa = dorder(ca); ob = dorder(cb)
       if (oa != ob) return (oa < ob) ? -1 : 1
       a = substr(a, 2); b = substr(b, 2)
     }
     da = ""; db = ""
     if (match(a, /^[0-9]+/)) { da = substr(a, 1, RLENGTH); a = substr(a, RLENGTH + 1) }
     if (match(b, /^[0-9]+/)) { db = substr(b, 1, RLENGTH); b = substr(b, RLENGTH + 1) }
     r = numcmp(da, db); if (r) return r
   }
   return 0
 }
 function debcmp(a, b,   ea, eb, ua, ub, ra, rb, r) {
   epoch(a); ea = E; a = S
   epoch(b); eb = E; b = S
   r = numcmp(ea, eb); if (r) return r
   splitvr(a); ua = V; ra = R
   splitvr(b); ub = V; rb = R
   r = dvercmp(ua, ub); if (r) return r
   return dvercmp(ra, rb)
 }
 function cmp(x, y) { return (mode == "deb") ? debcmp(x, y) : rpmevr(x, y) }
 BEGIN {
   for (i = 32; i < 127; i++) ASCII = ASCII sprintf("%c", i)
   if (op != "pick") { print cmp(a, b); exit }
 }
 # op=pick: of the "key<TAB>..." lines, print the one with the largest key above ref (one pass, O(N))
 {
   k = $0; sub(/\t.*/, "", k)
   if (cmp(k, ref) > 0 && (best == "" || cmp(k, best) > 0)) { best = k; bestline = $0 }
 }
 END { if (op == "pick" && bestline != "") print bestline }'
 
 ver_cmp() {  # $1=rpm|deb $2 $3 → -1 / 0 / 1
   if [ "$1" = deb ] && have dpkg; then
     if dpkg --compare-versions "$2" lt "$3"; then echo -1
     elif dpkg --compare-versions "$2" gt "$3"; then echo 1
     else echo 0; fi
     return
   fi
   LC_ALL=C awk -v mode="$1" -v a="$2" -v b="$3" "$AWK_VERCMP"
 }
 ver_lt() { [ "$(ver_cmp "$1" "$2" "$3")" = "-1" ]; }
 
 # "4.18.0-553.1.1" → BRANCH=4.18 (no subprocess)
 branch_of() {
   local v=${1%%[!0-9.]*} maj rest
   BRANCH=""
   maj=${v%%.*}; rest=${v#*.}
   [ -n "$maj" ] && [ "$rest" != "$v" ] || return 0
   rest=${rest%%.*}
   [ -n "$rest" ] && BRANCH="$maj.$rest"
 }
 
 # "4.18.0-553.1.1.el8_10.x86_64+debug" → EVR=4.18.0-553.1.1 (no subprocess)
 rpm_evr_of_krel() {
   local k=${1%%+*}
   case $k in
     *.x86_64|*.aarch64|*.ppc64le|*.ppc64|*.s390x|*.i[3-6]86|*.armv7hl|*.armv7l|*.riscv64|*.noarch) k=${k%.*} ;;
   esac
   case ${k##*.} in el[0-9]*|amzn[0-9]*|fc[0-9]*) k=${k%.*} ;; esac
   EVR=$k
 }
 
 # -----------------------------------------------------------------------------
 # System information
 # -----------------------------------------------------------------------------
 # Read os-release in one pass (handles quotes and CRLF, no subprocess)
 read_os_release() {
   local key val cr
   OS_ID=""; OS_LIKE=""; OS_VER=""; OS_NAME=""; OS_CODENAME=""
   [ -r "$OS_RELEASE_FILE" ] || OS_RELEASE_FILE=/usr/lib/os-release
   if [ ! -r "$OS_RELEASE_FILE" ]; then
     # Old RHEL family (5/6) without os-release: "CentOS release 6.10 (Final)"
     if [ "$OFFLINE" = 0 ] && [ -r /etc/redhat-release ]; then
       read -r OS_NAME < /etc/redhat-release
       OS_ID=rhel
       case $OS_NAME in *"release "[0-9]*) val=${OS_NAME#*release }; OS_VER=${val%% *} ;; esac
     fi
     return 0
   fi
   cr=$(printf '\r')
   local pretty="" name=""
   while IFS='=' read -r key val || [ -n "$key" ]; do
     val=${val%"$cr"}
     case $val in
       \"*\") val=${val#\"}; val=${val%\"} ;;
       \'*\') val=${val#\'}; val=${val%\'} ;;
     esac
     case $key in
       ID)               OS_ID=$val ;;
       ID_LIKE)          OS_LIKE=$val ;;
       VERSION_ID)       OS_VER=$val ;;
       PRETTY_NAME)      pretty=$val ;;
       NAME)             name=$val ;;
       VERSION_CODENAME) OS_CODENAME=$val ;;
     esac
   done < "$OS_RELEASE_FILE"
   OS_NAME=${pretty:-$name}
 }
 
 detect_os() {
   read_os_release
   OS_MAJOR=${OS_VER%%.*}
   case $OS_MAJOR in ''|*[!0-9]*) OS_MAJ_NUM=0 ;; *) OS_MAJ_NUM=$OS_MAJOR ;; esac
 
   FAMILY=generic
   case $KREL in
     *-Microsoft)    FAMILY=wsl1; return ;;   # WSL1: a Windows compatibility layer, not a Linux kernel
     *[Mm]icrosoft*) FAMILY=wsl; return ;;
     *-pve)          FAMILY=proxmox; return ;;
   esac
   case $OS_ID in
     almalinux) case $OS_NAME in *Kitten*) FAMILY=kitten ;; *) FAMILY=alma ;; esac ;;
     rhel)      FAMILY=rhel ;;
     centos)    FAMILY=centos ;;
     rocky)     FAMILY=rocky ;;
     ol)        FAMILY=oracle ;;
     amzn)      FAMILY=amazon ;;
     fedora)    FAMILY=fedora ;;
     debian)    FAMILY=debian ;;
     ubuntu)    FAMILY=ubuntu ;;
     sles|sled|sles_sap|sle_hpc)                     FAMILY=sles ;;
     sle-micro|sl-micro)                             FAMILY=slemicro ;;
     opensuse-leap)                                  FAMILY=leap ;;
     opensuse-tumbleweed|opensuse-slowroll)          FAMILY=tumbleweed ;;
     opensuse-microos|opensuse-aeon|opensuse-kalpa)  FAMILY=microos ;;
     arch|archarm|manjaro|manjaro-arm|endeavouros|cachyos|garuda|artix) FAMILY=arch ;;
     alpine|postmarketos) FAMILY=alpine ;;
     gentoo)    FAMILY=gentoo ;;
     *)
       case " $OS_LIKE " in
         *" ubuntu "*) FAMILY=ubuntu ;;
         *" rhel "*|*" centos "*|*" fedora "*)
           case $KREL in *.el[0-9]*) FAMILY=rhelclone ;; esac ;;
         *" arch "*)   FAMILY=arch ;;
         *" debian "*) FAMILY=debianlike ;;
       esac ;;
   esac
 }
 
 family_label() {
   case $FAMILY in
     alma)          echo "compared with fixed kernels in the AlmaLinux advisory (2026-10-16)" ;;
     kitten)        echo "AlmaLinux Kitten — fix due in the next regular kernel update" ;;
     rhel)          echo "Red Hat advisory (no fix yet) + kernel changelog check" ;;
     centos|rocky|rhelclone) echo "RHEL-family advisory + kernel changelog check" ;;
     oracle)        echo "compared with fixed kernels in Oracle Linux ELSA advisories (UEK)" ;;
     amazon)        echo "compared with fixed kernels in Amazon Linux ALAS advisories" ;;
     debian)        echo "compared with fixed package versions in the Debian security tracker" ;;
     debianlike)    echo "Debian derivative — Debian rules for Debian kernels, upstream rules otherwise" ;;
     ubuntu)        echo "Ubuntu CVE tracker (no fix yet) + kernel changelog check" ;;
     proxmox)       echo "Proxmox VE kernel — kernel changelog check" ;;
     sles|slemicro|leap) echo "SUSE security advisory (no fix yet) + kernel changelog check" ;;
     fedora|arch|tumbleweed|microos|alpine|gentoo) echo "distribution tracks upstream stable — compared with upstream fixed versions" ;;
     wsl)           echo "WSL2 (Microsoft kernel) — compared with upstream fixed versions" ;;
     wsl1)          echo "WSL1 — no Linux kernel involved" ;;
     *)             echo "unknown distribution — compared with upstream fixed versions (indicative only)" ;;
   esac
 }
 
 # Detect virtualization (VIRT) and containers (CTR) with a single systemd-detect-virt call
 detect_virt_container() {
   local v=""
   VIRT=""; CTR=""
   if [ -f /.dockerenv ]; then CTR=docker
   elif [ -f /run/.containerenv ]; then CTR=podman
   elif [ -s /run/systemd/container ]; then read -r CTR < /run/systemd/container
   elif [ -n "${KUBERNETES_SERVICE_HOST:-}" ]; then CTR=kubernetes
   elif [ -r /proc/1/environ ] && tr '\0' '\n' < /proc/1/environ 2>/dev/null | grep -q '^container='; then
     CTR=container
   fi
   if have systemd-detect-virt; then
     v=$(systemd-detect-virt 2>/dev/null)   # inside a container the container type is printed first
     case $v in
       ''|none) ;;
       docker|podman|lxc|lxc-libvirt|systemd-nspawn|openvz|rkt|proot|pouch|wsl) [ -n "$CTR" ] || CTR=$v ;;
       *) VIRT=$v ;;
     esac
   else
     if [ -z "$CTR" ] && grep -qE '/(docker|kubepods|lxc|libpod)' /proc/1/cgroup 2>/dev/null; then
       CTR=container
     fi
     grep -qw hypervisor /proc/cpuinfo 2>/dev/null && VIRT=hypervisor
   fi
   [ "$CTR" = wsl ] && CTR=""
 }
 
 # Does the kernel package changelog record the fix? (RHEL, SUSE, Oracle, Debian, Ubuntu families)
 # For rpm, a single 'rpm -qf --changelog' both finds the owning package and prints its changelog.
 #   CL_SRC records where the evidence came from (rpm|deb).
 changelog_has_fix() {
   local krel=$1 f
   CL_SRC=""
   if have rpm; then
     for f in "/lib/modules/$krel/vmlinuz" "/boot/vmlinuz-$krel"; do
       [ -e "$f" ] || continue
       rpm -qf --changelog "$f" 2>/dev/null | has_fix_text && { CL_SRC=rpm; return 0; }
       break
     done
   fi
   have gzip || return 1
   CL_SRC=deb
   for f in /usr/share/doc/linux-image-"$krel"/changelog.Debian.gz \
            /usr/share/doc/linux-modules-"$krel"/changelog.Debian.gz \
            /usr/share/doc/linux-image-unsigned-"$krel"/changelog.Debian.gz \
            /usr/share/doc/proxmox-kernel-"$krel"*/changelog.Debian.gz; do
     [ -r "$f" ] || continue
     gzip -dc "$f" 2>/dev/null | has_fix_text && return 0
   done
   return 1
 }
 
 # Only kernels that still have a bootable image (skips empty module dirs left by DKMS etc.).
 # Alpine and Gentoo may not put the release in the image name, so modules.dep is used there.
 list_installed_krels() {
   local d k
   for d in /lib/modules/*/; do
     k=${d%/}; k=${k##*/}
     [ "$k" = "*" ] && continue
     if [ -e "/lib/modules/$k/vmlinuz" ] || [ -e "/boot/vmlinuz-$k" ] ||
        { case $FAMILY in alpine|gentoo) true ;; *) false ;; esac && [ -e "/lib/modules/$k/modules.dep" ]; }; then
       printf '%s\n' "$k"
     fi
   done
 }
 
 # Was the running kernel's image replaced under the same name after boot (same-ABI in-place
 # update on Debian-like systems)? dpkg keeps the build time as mtime, so compare the install
 # time (ctime) with the boot time (btime).
 image_replaced_after_boot() {
   local f c k v bt=""
   for f in "/boot/vmlinuz-$1" "/lib/modules/$1/vmlinuz" ""; do [ -n "$f" ] && [ -e "$f" ] && break; done
   [ -n "$f" ] || return 1
   c=$(stat -c %Z "$f" 2>/dev/null) || return 1
   while read -r k v; do [ "$k" = btime ] && { bt=$v; break; }; done < /proc/stat
   [ -n "$bt" ] && [ "$c" -gt "$bt" ]
 }
 
 # If grubby can tell the default boot kernel, put it in DEFAULT_KREL (RHEL, Fedora, Amazon families)
 default_boot_krel() {
   local d
   DEFAULT_KREL=""
   have grubby || return 1
   d=$($SUDO grubby --default-kernel 2>/dev/null) || return 1
   case $d in /boot/vmlinuz-?*) DEFAULT_KREL=${d#/boot/vmlinuz-} ;; *) return 1 ;; esac
 }
 
 # Do the image and initramfs of the reboot target actually exist? (otherwise the boot may fail)
 boot_files_ok() {
   local k=$1 f img=0 ird=0
   case $FAMILY in arch|alpine|gentoo|microos|slemicro) return 0 ;; esac   # image names carry no release
   for f in "/boot/vmlinuz-$k" "/lib/modules/$k/vmlinuz" "/boot/Image-$k"; do [ -s "$f" ] && img=1; done
   for f in "/boot/initramfs-$k.img" "/boot/initrd.img-$k" "/boot/initrd-$k"; do [ -s "$f" ] && ird=1; done
   [ "$img" = 1 ] && [ "$ird" = 1 ]
 }
 
 # The newest kernel installed after the running one (usually the next default boot kernel)
 #   Result: NEW_KREL, NEW_DVER (Debian package version). Candidates are collected with shell
 #   builtins and compared in a single awk run.
 newest_installed() {
   local mode=rpm ref k list="" st pkg ver pick tab
   NEW_KREL=""; NEW_DVER=""
   tab=$(printf '\t')
   if [ "$FAMILY" = debian ]; then
     have dpkg-query || return 1
     mode=deb; ref=$RUN_DVER
     while IFS='|' read -r st pkg ver; do
       case $st in ii*) ;; *) continue ;; esac
       k=${pkg#linux-image-}
       [ -e "/lib/modules/$k/modules.dep" ] || continue
       list="$list$ver$tab$k$tab$ver
 "
     done <<EOF
 $(dpkg-query -W -f='${db:Status-Abbrev}|${Package}|${Version}\n' 'linux-image-*' 2>/dev/null)
 EOF
   else
     rpm_evr_of_krel "$KREL"; ref=$EVR
     for k in $(list_installed_krels); do
       [ "$k" = "$KREL" ] && continue
       [ "$FAMILY" = proxmox ] && case $k in *-pve) ;; *) continue ;; esac   # Proxmox kernels only
       rpm_evr_of_krel "$k"
       list="$list$EVR$tab$k$tab
 "
     done
   fi
   [ -n "$list" ] || return 1
   pick=$(printf '%s' "$list" | LC_ALL=C awk -v op=pick -v mode="$mode" -v ref="$ref" "$AWK_VERCMP")
   [ -n "$pick" ] || return 1
   pick=${pick#*"$tab"}
   NEW_KREL=${pick%%"$tab"*}
   NEW_DVER=${pick#*"$tab"}
 }
 
 # Determine and judge the next boot kernel.
 #   The grubby default when known, otherwise the newest kernel installed after the running one.
 #   Result: NB_KREL / NB_DVER / NB_STATUS (NB_KREL is empty when the next boot is the running kernel)
 #           NB_ALT = a fixed kernel that is installed but is not the default boot kernel
 next_boot_eval() {
   NB_KREL=""; NB_DVER=""; NB_STATUS=""; NB_ALT=""
   newest_installed || { NEW_KREL=""; NEW_DVER=""; }
   if default_boot_krel; then
     [ "$DEFAULT_KREL" != "$KREL" ] && NB_KREL=$DEFAULT_KREL
   else
     NB_KREL=$NEW_KREL; NB_DVER=$NEW_DVER
   fi
   if [ -n "$NB_KREL" ]; then
     evaluate_kernel "$NB_KREL" "$NB_DVER"; NB_STATUS=$E_STATUS
   fi
   if [ "$NB_STATUS" != fixed ] && [ -n "$NEW_KREL" ] && [ "$NEW_KREL" != "$NB_KREL" ]; then
     evaluate_kernel "$NEW_KREL" "$NEW_DVER"
     [ "$E_STATUS" = fixed ] && NB_ALT=$NEW_KREL
   fi
   return 0
 }
 
 # Will a reboot come up on a fixed kernel? → sets REBOOT_TARGET / REBOOT_KREL
 installed_fix_ready() {
   REBOOT_TARGET=""; REBOOT_KREL=""
   next_boot_eval
   [ "$NB_STATUS" = fixed ] || return 1
   REBOOT_KREL=$NB_KREL
   REBOOT_TARGET="$NB_KREL${NB_DVER:+ (package $NB_DVER)}"
 }
 
 # Is any kernel livepatch active? (reads sysfs only)
 livepatch_active() {
   local f v
   for f in /sys/kernel/livepatch/*/enabled; do
     [ -r "$f" ] || continue
     read -r v < "$f" 2>/dev/null && [ "$v" = 1 ] && return 0
   done
   return 1
 }
 
 # Has a livepatch applied the fix to the running kernel?
 # Without an active livepatch the full rpm database query (rpm -qa) is skipped entirely.
 livepatch_has_fix() {
   local p rel
   if livepatch_active; then
     if have canonical-livepatch && canonical-livepatch status --verbose 2>/dev/null | has_fix_text; then
       LP_NAME="Canonical Livepatch"; return 0
     fi
     if have rpm; then
       rpm_evr_of_krel "$KREL"; rel=$EVR
       case $rel in *-default|*-azure|*-rt|*-64kb) rel=${rel%-*} ;; esac
       # Only the package built for the running kernel (RHEL/SUSE use dots→underscores, Amazon keeps dots)
       for p in $(rpm -qa 'kpatch-patch*' 'kernel-livepatch-*' 2>/dev/null); do
         case $p in *-"${rel//./_}"-*|*-"$rel"-*) ;; *) continue ;; esac
         if rpm -q --changelog "$p" 2>/dev/null | has_fix_text; then LP_NAME=$p; return 0; fi
       done
     fi
   fi
   if have uptrack-show && uptrack-show 2>/dev/null | has_fix_text; then
     LP_NAME="Oracle Ksplice"; return 0
   fi
   return 1
 }
 
 # -----------------------------------------------------------------------------
 # Verdict — results go into E_STATUS / E_FIXED / E_BASIS / E_ADV / E_PKG / E_MODE
 #   E_STATUS: fixed | vulnerable | pending | eol | unaffected | unknown
 # -----------------------------------------------------------------------------
 upstream_eval() {  # pure shell pattern parsing, no subprocess
   local rel=$1 base maj min pat rest rc="" br v fpat
   E_MODE=upstream
   base=${rel%%[!0-9.]*}
   maj=${base%%.*}; rest=${base#*.}
   min=${rest%%.*}; pat=${rest#*.}; pat=${pat%%.*}
   [ "$pat" = "$rest" ] && pat=0          # x.y form
   case $maj:$min:$pat in
     *[!0-9:]*|:*|*::*|*:) E_STATUS=unknown; E_BASIS="cannot parse kernel version ($rel)"; return ;;
   esac
   [ "$rest" = "$base" ] && { E_STATUS=unknown; E_BASIS="cannot parse kernel version ($rel)"; return; }
   base="$maj.$min.$pat"
   # rc number: rcN after a non-letter, e.g. "-rc6", ".rc6", Ubuntu mainline "070300rc5"
   case $rel in
     *[!A-Za-z]rc[0-9]*) rc=${rel#*[!A-Za-z]rc}; rc=${rc%%[!0-9]*} ;;
   esac
   br="$maj.$min"
 
   if [ "$maj" -lt 2 ] || { [ "$maj" -eq 2 ] && [ "$min" -lt 6 ]; } || { [ "$br" = 2.6 ] && [ "$pat" -lt 27 ]; }; then
     case $rel in
       *.el[0-9]*|*.amzn*)   # vendor kernels may carry backported networking code under old version numbers
         E_STATUS=unknown; E_BASIS="$base vendor kernel — version predates 2.6.27 but backports must be checked" ;;
       *)
         E_STATUS=unaffected; E_BASIS="$base — older than 2.6.27, where the vulnerable code was introduced" ;;
     esac
     return
   fi
   if [ "$maj" -gt 7 ] || { [ "$maj" -eq 7 ] && [ "$min" -ge 3 ]; }; then
     E_FIXED="7.3-rc7"
     if [ "$br" = 7.3 ] && [ -n "$rc" ] && [ "$rc" -lt 7 ]; then
       E_STATUS=vulnerable; E_BASIS="7.3-rc$rc < mainline fix point 7.3-rc7"
     else
       E_STATUS=fixed; E_BASIS="$base — mainline 7.3-rc7 or later (includes the fix)"
     fi
     return
   fi
   for v in $UPSTREAM_FIXED; do
     [ "${v%.*}" = "$br" ] || continue
     fpat=${v##*.}; E_FIXED=$v
     if [ "$pat" -ge "$fpat" ]; then
       E_STATUS=fixed; E_BASIS="$base ≥ upstream fixed version $v"
     else
       E_STATUS=vulnerable; E_BASIS="$base < upstream fixed version $v"
     fi
     return
   done
   E_STATUS=eol; E_BASIS="upstream $br branch is end of life — no fixed release for this branch"
 }
 
 nonvendor_eval() {  # $1=kernel release $2=reason
   upstream_eval "$1"
   E_BASIS="$2 → upstream rules: $E_BASIS"
 }
 
 rpm_table_eval() {  # $1=kernel release $2=table name
   local evr br t_br t_cmp t_disp t_adv t_pkg
   rpm_evr_of_krel "$1"; evr=$EVR
   branch_of "$evr"; br=$BRANCH
   while IFS='|' read -r t_br t_cmp t_disp t_adv t_pkg; do
     [ -n "$t_br" ] && [ "$t_br" = "$br" ] || continue
     E_FIXED=$t_disp; E_ADV=$t_adv; E_PKG=$t_pkg
     if ver_lt rpm "$evr" "$t_cmp"; then
       E_STATUS=vulnerable; E_BASIS="kernel $evr < fixed version $t_cmp"
     else
       E_STATUS=fixed; E_BASIS="kernel $evr ≥ fixed version $t_cmp"
     fi
     return 0
   done <<EOF
 $(vendor_table "$2")
 EOF
   return 1
 }
 
 deb_eval() {  # $1=kernel release $2=Debian package version
   local v=$2 up br t
   if [ -z "$v" ]; then
     if [ "$OFFLINE" = 1 ]; then
       E_STATUS=unknown
       E_BASIS="Debian kernels need the package version — pass the target server's 'uname -v' with --uname-v"
       return
     fi
     nonvendor_eval "$1" "not a Debian-packaged kernel"; return
   fi
   case $v in *+rpt*|*rpi*) nonvendor_eval "$1" "Raspberry Pi kernel"; return ;; esac
   up=${v#*:}; branch_of "$up"; br=$BRANCH
   case $br in
     6.1)  t="6.1.190-1~";  E_FIXED="6.1.190-1"; E_ADV="bookworm-security, DLA-4841-1" ;;  # ~ : also covers bullseye-LTS ~deb11u
     6.12) t="6.12.113-1~"; E_FIXED="6.12.113-1"; E_ADV="trixie-security, DSA-6568-1" ;;
     7.2)  t="7.2.11-1~";   E_FIXED="7.2.11-1"; E_ADV="forky/sid" ;;
     *)
       upstream_eval "${up%%-*}"
       if [ "$E_STATUS" = fixed ] || [ "$E_STATUS" = unaffected ]; then
         E_BASIS="Debian kernel $v → upstream rules: $E_BASIS"
       else
         E_STATUS=eol
         E_BASIS="kernel branch $br is not tracked by Debian security — end-of-life release (bullseye or older) or non-standard kernel"
       fi
       E_MODE=vendor
       return ;;
   esac
   if ver_lt deb "$v" "$t"; then
     E_STATUS=vulnerable; E_BASIS="Debian kernel $v < fixed version $E_FIXED"
   else
     E_STATUS=fixed; E_BASIS="Debian kernel $v ≥ fixed version $E_FIXED"
   fi
 }
 
 # Verdict: decide from vendor tables / upstream versions first; only when that is inconclusive
 # (no fix yet, end of life, unknown) is the kernel changelog (several MB) checked. Distributions
 # decided by a table never read a changelog.
 #   E_INPLACE=1: a package with the running kernel's name was replaced by a fixed one after boot → reboot
 evaluate_kernel() {  # $1=kernel release $2=Debian package version (optional)
   E_INPLACE=0
   evaluate_by_version "$@"
   case $E_STATUS in pending|unknown|eol) ;; *) return ;; esac
   [ "$OFFLINE" = 0 ] || return
   if changelog_has_fix "$1"; then
     # A deb changelog belongs to the package on disk — if the running kernel was replaced
     # after boot, the fix is not in the kernel that is in memory yet
     if [ "$1" = "$KREL" ] && [ "$CL_SRC" = deb ] && image_replaced_after_boot "$1"; then
       E_INPLACE=1
       E_BASIS="$E_BASIS · the package that replaced this kernel after boot contains the fix (reboot needed)"
       return
     fi
     E_STATUS=fixed; E_MODE=changelog
     E_BASIS="the kernel package changelog records $CVE or the fix commit"
   else
     case $FAMILY in
       rhel|centos|rocky|rhelclone|kitten|oracle|ubuntu|proxmox|sles|slemicro|leap|debian|debianlike)
         E_BASIS="$E_BASIS · no fix recorded in the kernel changelog either" ;;
     esac
   fi
 }
 
 evaluate_by_version() {
   local krel=$1 dver=${2:-}
   E_STATUS=unknown; E_FIXED=""; E_BASIS=""; E_ADV=""; E_PKG=""; E_MODE=vendor
 
   # On RPM distributions, a kernel that is not the distro kernel (ELRepo, self-built) uses upstream rules
   case $FAMILY in
     alma|kitten|rhel|centos|rocky|rhelclone|oracle|amazon)
       case $krel in
         *elrepo*)                 nonvendor_eval "$krel" "ELRepo kernel"; return ;;
         *.el[0-9]*|*.amzn[0-9]*) ;;
         *)                       nonvendor_eval "$krel" "not the distribution kernel"; return ;;
       esac ;;
   esac
 
   case $FAMILY in
     alma)
       case $OS_MAJ_NUM in
         8|9|10) rpm_table_eval "$krel" "alma$OS_MAJ_NUM" ||
                   nonvendor_eval "$krel" "not the default kernel branch of AlmaLinux $OS_MAJ_NUM" ;;
         *)      E_STATUS=eol; E_BASIS="end-of-life AlmaLinux release ($OS_VER)" ;;
       esac ;;
     kitten)
       E_STATUS=pending
       E_BASIS="AlmaLinux Kitten gets the fix in the next regular kernel update (no separate build)" ;;
     rhel|centos|rocky|rhelclone)
       if { [ "$FAMILY" = rhel ] && [ "$OS_MAJ_NUM" -lt 7 ]; } ||
          { [ "$FAMILY" = centos ] && [ "$OS_MAJ_NUM" -le 8 ]; }; then
         E_STATUS=eol; E_BASIS="end-of-life release (${OS_NAME:-$OS_ID $OS_VER}) — no fixed kernel will ship"
       elif [ "$FAMILY" = rhel ]; then
         E_STATUS=pending; E_BASIS="Red Hat: RHEL 7/8/9/10 affected, no fixed kernel released (as of $DATA_DATE)"
       else
         E_STATUS=pending; E_BASIS="no fixed RHEL kernel yet — none published for this distribution either (as of $DATA_DATE)"
       fi ;;
     oracle)
       case $krel in
         *uek*)
           rpm_table_eval "$krel" uek || {
             rpm_evr_of_krel "$krel"; branch_of "$EVR"
             E_STATUS=pending
             E_BASIS="no advisory for this UEK release (${BRANCH:-?}) — move to UEK R6 or later"
           } ;;
         *)
           E_STATUS=pending
           E_BASIS="no advisory for RHCK (Red Hat compatible kernel) (as of $DATA_DATE) — UEK is fixed" ;;
       esac ;;
     amazon)
       case $OS_VER in
         2|2023)
           rpm_table_eval "$krel" "al$OS_VER" ||
             { E_STATUS=unknown; E_BASIS="kernel branch not covered by ALAS advisories ($krel)"; } ;;
         *)
           E_STATUS=eol; E_BASIS="Amazon Linux 1 is end of life — no advisory" ;;
       esac ;;
     debian)
       deb_eval "$krel" "$dver" ;;
     debianlike)
       if [ -n "$dver" ]; then deb_eval "$krel" "$dver"
       else nonvendor_eval "$krel" "distribution's own kernel"; fi ;;
     ubuntu)
       E_STATUS=pending
       E_BASIS="Ubuntu CVE tracker: every kernel package 'Needs evaluation' — no fix released (as of $DATA_DATE)" ;;
     proxmox)
       E_STATUS=unknown
       E_BASIS="no published fix information for the Proxmox VE kernel (based on the Ubuntu kernel)" ;;
     sles|slemicro)
       case $FAMILY:$OS_VER in
         sles:11*|sles:12|sles:12.[0-4]|sles:15|sles:15.[1-3]|slemicro:5.[0-2])
           E_STATUS=eol; E_BASIS="end-of-life SUSE release ($OS_VER) — not proactively patched" ;;
         *)
           E_STATUS=pending; E_BASIS="SUSE advisory: kernel-default etc. 'Affected', state 'Pending' — no fix released (as of $DATA_DATE)" ;;
       esac ;;
     leap)
       case $OS_MAJ_NUM in
         15|42) E_STATUS=eol; E_BASIS="openSUSE Leap $OS_VER is end of life" ;;
         *)     E_STATUS=pending; E_BASIS="SUSE advisory: Leap 16 'Affected', state 'Pending' — no fix released (as of $DATA_DATE)" ;;
       esac ;;
     fedora|arch|tumbleweed|microos|alpine|gentoo|wsl)
       upstream_eval "$krel" ;;
     wsl1)
       E_STATUS=unaffected; E_BASIS="WSL1 has no Linux kernel; Windows handles the system calls" ;;
     *)
       upstream_eval "$krel"
       [ "$E_STATUS" = eol ] && E_STATUS=unknown
       E_BASIS="estimated from upstream versions (check distribution backports): $E_BASIS" ;;
   esac
 }
 
 status_label() {
   case $1 in
     fixed)       printf '%sSAFE — running a fixed kernel%s' "$C_GRN" "$C_OFF" ;;
     unaffected)  printf '%sNOT AFFECTED — this kernel does not contain the vulnerable code%s' "$C_GRN" "$C_OFF" ;;
     livepatched) printf '%sSAFE (temporary) — fix applied by livepatch%s' "$C_GRN" "$C_OFF" ;;
     reboot)      printf '%sREBOOT NEEDED — fixed kernel installed, still running the old one%s' "$C_YEL" "$C_OFF" ;;
     vulnerable)  printf '%sVULNERABLE — a fixed kernel is available, update needed%s' "$C_RED" "$C_OFF" ;;
     pending)     printf '%sVULNERABLE — no fixed kernel from the distribution yet (as of %s)%s' "$C_RED" "$DATA_DATE" "$C_OFF" ;;
     eol)         printf '%sVULNERABLE — end-of-life release/branch, no fixed kernel%s' "$C_RED" "$C_OFF" ;;
     *)           printf '%sUNDETERMINED — check manually%s' "$C_YEL" "$C_OFF" ;;
   esac
 }
 
 # -----------------------------------------------------------------------------
 # Exposure — the main target is a virtualization host running untrusted guests
 # -----------------------------------------------------------------------------
 read_sysctl() {  # $1=file → SYSCTL_VAL (empty if missing, no subprocess)
   SYSCTL_VAL=""
   [ -r "$1" ] && read -r SYSCTL_VAL < "$1" 2>/dev/null
   return 0
 }
 
 check_exposure() {
   local any=0 n procs v mods="" m _
   HV_HOST=0
   if [ -e /dev/kvm ]; then
     line "- /dev/kvm present: this system can run KVM virtual machines"; any=1
   fi
   # Read /proc/modules only once
   if [ -r /proc/modules ]; then
     while read -r m _; do mods="$mods $m"; done < /proc/modules
   fi
   case "$mods " in *" vhost_net "*)
     line "- vhost_net module loaded: virtio-net backend in use"; any=1; HV_HOST=1 ;;
   esac
   case "$mods " in *" tun "*|*" tap "*|*" macvtap "*)
     line "- tun/tap module loaded"; any=1 ;;
   esac
   set -- /sys/class/net/*/tun_flags
   if [ -e "$1" ]; then n=$#; else n=0; fi
   if [ "$n" -gt 0 ]; then
     line "- $n TUN/TAP interface(s) present"; any=1
   fi
   # A single grep reads /proc/*/comm directly; awk removes duplicates and joins
   #   kvm = Proxmox VM process, vhost-<pid> = virtio-net vhost worker thread
   procs=$(grep -hE '^(qemu-system|qemu-kvm|kvm$|vhost-[0-9]|firecracker|cloud-hyperviso|crosvm|libvirtd|virtqemud|VBoxHeadless|VirtualBoxVM|vmware-vmx)' \
             /proc/[0-9]*/comm 2>/dev/null | awk '{ sub(/^vhost-[0-9]+$/, "vhost") } !s[$0]++ { printf "%s ", $0 }')
   if [ -n "$procs" ]; then
     line "- virtualization processes running: $procs"; any=1; HV_HOST=1
   fi
   if [ "$FAMILY" = proxmox ] && [ "$HV_HOST" = 0 ]; then
     line "- Proxmox VE node"; any=1; HV_HOST=1
   fi
   [ "$any" = 1 ] || line "- no sign of a virtualization host (no KVM, TUN/TAP or VM processes)"
   if [ "$HV_HOST" = 1 ]; then
     line "${C_RED}→ Looks like a virtualization host. It is the direct target of guest→host escape: patch it first.${C_OFF}"
   fi
   [ -n "$VIRT" ] && line "- This system is a VM guest ($VIRT). Patching the host kernel is up to the host operator/provider."
 
   if [ -r /proc/sys/kernel/unprivileged_userns_clone ]; then
     read_sysctl /proc/sys/kernel/unprivileged_userns_clone; v=$SYSCTL_VAL
     if [ "$v" = 0 ]; then line "- unprivileged user namespaces: blocked (kernel.unprivileged_userns_clone=0)"
     else line "- unprivileged user namespaces: allowed (kernel.unprivileged_userns_clone=$v)"; fi
   elif [ -r /proc/sys/user/max_user_namespaces ]; then
     read_sysctl /proc/sys/user/max_user_namespaces; v=$SYSCTL_VAL
     if [ "$v" = 0 ]; then line "- user namespaces: blocked (user.max_user_namespaces=0)"
     else line "- user namespaces: allowed (user.max_user_namespaces=$v)"; fi
   fi
   read_sysctl /proc/sys/kernel/apparmor_restrict_unprivileged_userns
   if [ "$SYSCTL_VAL" = 1 ]; then
     line "  (AppArmor restricts unprivileged namespace privileges)"
   fi
   note "The namespace lines are informational. An unprivileged user who gains CAP_NET_ADMIN/CAP_NET_RAW inside a namespace may reach the TUN/TAP and packet-socket paths, which could matter for local attacks (an assumption), but no vendor has published this as a mitigation."
 }
 
 # -----------------------------------------------------------------------------
 # Remediation
 # -----------------------------------------------------------------------------
 remedy_eol() {
   line "No fixed kernel will be released for this release/kernel branch. $1"
 }
 
 remedy_custom() {
   line "Judged as a kernel that is not the distribution kernel (ELRepo, self-built, ...)."
   line "Apply the kernel provider's update or move to an upstream stable fixed version or later:"
   line "  $UPSTREAM_TEXT"
   line "  Fix commit: $FIX_COMMIT ($FIX_URL)"
   cmt "The kernel CNA recommends the latest stable kernel over cherry-picking single commits"
   cmt "ELRepo example: sudo dnf --enablerepo=elrepo-kernel update 'kernel-ml*' 'kernel-lt*'"
   cmt "Or boot the distribution kernel again and apply the distribution patch"
 }
 
 remedy_rhel_like() {  # $1=status
   local pm=dnf core=kernel-core
   case $OS_MAJ_NUM in [1-7]) pm=yum; core=kernel ;; esac
   if [ "$1" = eol ]; then
     remedy_eol "Move to a supported release (RHEL, Rocky, AlmaLinux 8/9/10, CentOS Stream 9/10)."
     return
   fi
   line "No fixed kernel has been released as of $DATA_DATE. (Red Hat: no mitigation available)"
   cmt "1) Check whether a fix has been released"
   cmd "sudo $pm updateinfo list --cve $CVE"
   cmd "rpm -q --changelog $core | grep -iE '$CVE|checksum_start'"
   cmt "2) Once released, apply it and reboot"
   cmd "sudo $pm update --cve $CVE        # or: sudo $pm update 'kernel*'"
   cmd "sudo reboot"
   if [ "$FAMILY" = rhel ]; then
     cmt "If Red Hat ships a kpatch livepatch, it can be applied without a reboot"
     cmd "sudo $pm install \"kpatch-patch = \$(uname -r)\""
   fi
 }
 
 remedy_family() {  # $1=status
   local st=$1 pm
   case $FAMILY in
     alma)
       if [ "$st" = eol ]; then remedy_eol "Upgrade to a supported AlmaLinux (8.10 / 9 / 10)."; return; fi
       line "Fixed kernel: ${R_FIXED:-see the AlmaLinux advisory} or later"
       cmt "1) First try the regular repositories"
       cmd "sudo dnf clean metadata && sudo dnf update 'kernel*'"
       cmt "2) If it is not there yet, install from the testing repo (AlmaLinux advisory of 2026-10-16)"
       cmd "sudo dnf install -y almalinux-release-testing"
       cmd "sudo dnf update 'kernel*' --enablerepo=almalinux-testing"
       cmd "sudo dnf remove -y almalinux-release-testing     # clean up the testing repo"
       cmt "3) Reboot and confirm the fixed version with 'uname -r'"
       cmd "sudo reboot"
       ;;
     kitten)
       line "AlmaLinux Kitten will include the fix in its next regular kernel update."
       cmd "sudo dnf update 'kernel*'"
       cmd "sudo reboot"
       ;;
     rhel|centos|rocky|rhelclone)
       remedy_rhel_like "$st"
       ;;
     oracle)
       pm=dnf; case $OS_MAJ_NUM in [1-7]) pm=yum ;; esac
       case $KREL in
         *uek*)
           if [ "$st" = vulnerable ]; then
             line "Fixed kernel: $R_FIXED or later ($R_ADV)"
             cmd "sudo $pm update kernel-uek"
             cmd "sudo reboot"
             cmt "With a Ksplice subscription, apply without a reboot: sudo uptrack-upgrade -y"
           else
             line "There is no advisory for the UEK release in use. Switch to a fixed UEK."
             line "  UEK R6 5.4.17-2136.360.3.1 (OL7/8) · UEK R7 5.15.0-325.221.6.4 (OL8/9) · UEK R8 6.12.0-207.111.5.4 (OL9/10)"
             cmd "sudo $pm install kernel-uek"
             cmd "sudo reboot"
           fi ;;
         *)
           line "There is no fix for RHCK (Red Hat compatible kernel) yet. UEK is already fixed, so switching to UEK is the fastest route."
           cmd "sudo $pm install kernel-uek"
           cmd "sudo grubby --info=ALL | grep -E '^kernel'        # find the installed UEK path"
           cmd "sudo grubby --set-default /boot/vmlinuz-<UEK version>"
           cmd "sudo reboot"
           cmt "If you must stay on RHCK, check for a release: sudo $pm updateinfo list --cve $CVE"
           ;;
       esac ;;
     amazon)
       case $OS_VER in
         2)
           if [ -n "$R_ADV" ]; then
             line "Fixed kernel: $R_FIXED or later ($R_ADV)"
             cmd "sudo yum update --advisory $R_ADV        # or: sudo yum update kernel"
           else
             cmd "sudo yum update kernel"
           fi
           cmd "sudo reboot" ;;
         2023)
           if [ -n "$R_ADV" ]; then
             line "Fixed kernel: $R_FIXED or later ($R_ADV)"
             cmd "sudo dnf update $R_PKG --releasever 2023.12.20261012"
             cmt "or: sudo dnf update --advisory $R_ADV --releasever 2023.12.20261012"
           else
             cmd "sudo dnf update 'kernel*' --releasever latest"
           fi
           cmd "sudo reboot" ;;
         *)
           remedy_eol "Move to Amazon Linux 2023." ;;
       esac
       note "AWS states that the EC2, Lambda and Fargate host infrastructure is not affected. The steps above are for this instance's own kernel."
       ;;
     debian)
       if [ "$st" = eol ]; then
         remedy_eol "Upgrade to bookworm (12) or later, or look at extended support such as Freexian ELTS."
         return
       fi
       line "Fixed kernel: $R_FIXED or later ($R_ADV)"
       cmt "1) Make sure the security repository (<codename>-security) is enabled"
       cmd "grep -rhE '^[^#].*security' /etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null"
       cmt "2) Update and reboot"
       cmd "sudo apt update"
       cmd "sudo apt full-upgrade"
       cmt "If the kernel metapackage is missing: sudo apt install linux-image-\$(dpkg --print-architecture)"
       case $RUN_DVER in *bpo*)
         cmt "Using a backports kernel: sudo apt install -t ${OS_CODENAME:-<codename>}-backports linux-image-\$(dpkg --print-architecture)" ;;
       esac
       cmd "sudo reboot"
       cmt "3) After the reboot, check that 'Debian <version>' in 'uname -v' is the fixed version or later"
       ;;
     debianlike)
       line "Update the distribution kernel to the latest version. (fixed in upstream ${R_FIXED:-stable} or later)"
       cmd "sudo apt update && sudo apt full-upgrade"
       cmd "sudo reboot"
       ;;
     ubuntu)
       line "No fixed Ubuntu kernel has been released as of $DATA_DATE. (every kernel 'Needs evaluation')"
       cmt "1) Check whether a fix has been released (Ubuntu Pro client)"
       cmd "pro fix $CVE --dry-run"
       cmt "or https://ubuntu.com/security/$CVE"
       cmt "2) If you use Livepatch, check whether it has been applied"
       cmd "sudo canonical-livepatch status --verbose | grep -A2 $CVE"
       cmt "3) Once released, apply it and reboot"
       cmd "sudo apt update && sudo apt full-upgrade"
       cmd "sudo reboot"
       ;;
     proxmox)
       line "Whether the Proxmox VE kernel (based on the Ubuntu kernel) is fixed must be checked in Proxmox announcements."
       cmd "pveversion -v | grep -E 'proxmox-kernel|pve-manager'"
       cmd "apt changelog proxmox-kernel-\$(uname -r)-signed 2>/dev/null | grep -iE '$CVE|checksum_start'"
       cmt "When a fixed kernel is out (pve-enterprise or pve-no-subscription repository)"
       cmd "sudo apt update && sudo apt full-upgrade"
       cmt "Migrate or shut down the guests, then reboot"
       cmd "sudo reboot"
       ;;
     sles|slemicro|leap)
       if [ "$st" = eol ]; then
         if [ "$FAMILY" = leap ]; then remedy_eol "Upgrade to openSUSE Leap 16."
         else remedy_eol "Upgrade to a supported service pack (including LTSS)."; fi
         return
       fi
       line "No fixed SUSE kernel has been released as of $DATA_DATE. (state 'Pending')"
       cmt "1) Check whether a fix has been released"
       cmd "sudo zypper refresh && sudo zypper list-patches --cve=$CVE"
       cmt "2) Once released, apply it and reboot"
       if [ "$FAMILY" = slemicro ]; then cmd "sudo transactional-update patch"
       else cmd "sudo zypper patch --cve=$CVE"; fi
       cmd "sudo reboot"
       cmt "With SLE Live Patching, a kernel-livepatch patch can be applied without a reboot"
       ;;
     fedora)
       if [ "$st" = eol ]; then
         line "This kernel branch is no longer supported upstream. Update the kernel, and if the Fedora release is end of life, move to a supported release."
         cmd "sudo dnf upgrade --refresh"
         cmd "sudo dnf system-upgrade download --releasever=<new release>"
         return
       fi
       line "Fixed in: upstream $R_FIXED or later"
       cmd "sudo dnf upgrade --refresh 'kernel*'"
       cmt "If it is not in the stable repository yet, install from updates-testing"
       cmd "sudo dnf upgrade --refresh --enablerepo=updates-testing 'kernel*'"
       cmd "sudo reboot"
       ;;
     arch)
       line "Fixed in: linux ${R_FIXED:-7.2.11} or later / linux-lts 6.12.113 · 6.18.57 or later"
       cmd "sudo pacman -Syu"
       cmd "sudo reboot"
       ;;
     tumbleweed)
       line "Fixed in: upstream ${R_FIXED:-stable} or later"
       cmd "sudo zypper refresh && sudo zypper dup"
       cmd "sudo reboot"
       ;;
     microos)
       cmd "sudo transactional-update dup"
       cmd "sudo reboot"
       ;;
     alpine)
       line "Fixed in: upstream ${R_FIXED:-stable} or later (linux-lts / linux-virt)"
       cmd "sudo apk update && sudo apk upgrade"
       cmd "sudo reboot"
       [ "$st" = eol ] && cmt "If the kernel branch is end of life, the Alpine release itself must be upgraded"
       ;;
     gentoo)
       line "Fixed in: upstream ${R_FIXED:-stable} or later"
       cmd "sudo emerge --sync"
       cmd "sudo emerge --ask --update --oneshot sys-kernel/gentoo-kernel-bin   # or gentoo-kernel"
       cmt "If you build from gentoo-sources, rebuild from a fixed version or later"
       cmd "sudo reboot"
       ;;
     wsl)
       line "The WSL2 kernel is shipped by Microsoft. Run this in Windows PowerShell:"
       cmd "wsl --update"
       cmd "wsl --shutdown"
       note "The WSL2 host is Windows (Hyper-V), so the 'VM → Linux host escape' scenario does not apply. Only the WSL kernel itself was judged, using upstream versions."
       ;;
     *)
       line "Check your distribution vendor's security advisory and update the kernel."
       line "For a self-built kernel, move to an upstream stable fixed version or later:"
       line "  $UPSTREAM_TEXT"
       line "  Fix commit: $FIX_COMMIT ($FIX_URL)"
       ;;
   esac
 }
 
 print_remedy() {  # $1=final status
   local st=$1
   case $st in
     fixed|unaffected)
       line "${C_GRN}No further action needed.${C_OFF}"
       [ -n "$VIRT" ] && note "This system is a VM guest ($VIRT). Check separately whether the host (cloud/hosting provider) kernel is patched."
       return ;;
     livepatched)
       line "A livepatch ($LP_NAME) has applied the fix to the running kernel."
       line "At the next maintenance window, install the fixed kernel package and reboot."
       return ;;
     reboot)
       line "A fixed kernel is already installed: $REBOOT_TARGET"
       line "It takes effect after a reboot."
       [ "$HV_HOST" = 1 ] && cmt "This is a virtualization host. Migrate or shut down the guest VMs before rebooting."
       cmd "sudo reboot"
       cmt "Run this script again after the reboot to confirm"
       return ;;
   esac
 
   if [ "$R_MODE" = upstream ]; then
     case $FAMILY in
       fedora|arch|tumbleweed|microos|alpine|gentoo|wsl|generic|debianlike) remedy_family "$st" ;;
       debian) FAMILY=debianlike remedy_family "$st" ;;
       *)      remedy_custom ;;
     esac
   else
     remedy_family "$st"
   fi
 
   printf '\n'
   note "There is no official workaround (sysctl, module blacklisting, ...). Booting a fixed kernel is the only fix."
   if [ "$HV_HOST" = 1 ]; then
     note "Patching only the guest OS kernels does not protect the host. Migrate or shut down the guests before rebooting."
   fi
   case $st in pending|eol|unknown)
     note "Until patched, limit the creation of untrusted workloads (VMs, microVMs, sandboxes) and keep them away from sensitive systems. (This lowers risk; it is not a fix)" ;;
   esac
   [ -n "$VIRT" ] && note "This system is a VM guest ($VIRT). Also check whether the host (cloud/hosting provider) is patched."
 }
 
 print_refs() {
   line "https://www.cve.org/CVERecord?id=$CVE"
   line "https://nvd.nist.gov/vuln/detail/$CVE"
   line "https://pwn.ai/blog/pwnescape"
   line "https://almalinux.org/blog/2026-10-16-pwnescape-cve-2026-99999/"
   line "https://www.penligent.ai/hackinglabs/cve-2026-99999/"
   line "https://news.hada.io/topic?id=35568"
   case $FAMILY in
     debian|debianlike) line "https://security-tracker.debian.org/tracker/$CVE" ;;
     ubuntu|proxmox)    line "https://ubuntu.com/security/$CVE" ;;
     alma|kitten|rhel|centos|rocky|rhelclone)
                        line "https://access.redhat.com/security/cve/cve-2026-99999" ;;
     oracle)            line "https://linux.oracle.com/cve/$CVE.html" ;;
     amazon)            line "https://explore.alas.aws.amazon.com/$CVE.html" ;;
     sles|slemicro|leap|tumbleweed|microos)
                        line "https://www.suse.com/security/cve/$CVE.html" ;;
     *)                 line "$FIX_URL" ;;
   esac
 }
 
 print_refs_section() {
   section "References"
   print_refs
   note "Verdict data as of $DATA_DATE. Vendor advisories keep changing, so check the latest ones too."
 }
 
 show_manual() {
   section "Remediation (manual)"
   print_remedy "$FINAL"
   print_refs_section
 }
 
 # -----------------------------------------------------------------------------
 # Automatic patching (menu option 1)
 # -----------------------------------------------------------------------------
 run() {
   printf '  %s$ %s%s\n' "$C_DIM" "$*" "$C_OFF"
   "$@"
 }
 
 setup_sudo() {
   SUDO=""
   [ "$(id -u)" = 0 ] && return 0
   if command -v sudo >/dev/null 2>&1; then SUDO=sudo; return 0; fi
   line "${C_RED}Root privileges are required but sudo is not available. Run this again as root.${C_OFF}"
   return 1
 }
 
 can_autopatch() {
   case $FAMILY in wsl|wsl1) return 1 ;; esac   # rebooting inside WSL never boots a distribution kernel
   [ "$FINAL" = reboot ] && return 0
   [ "$FINAL" = eol ] && return 1
   case $FAMILY in
     debian|debianlike|fedora|arch|tumbleweed|microos|alpine) return 0 ;;
     alma|kitten|rhel|centos|rocky|rhelclone|oracle|amazon|ubuntu|proxmox|sles|slemicro|leap)
       [ "$R_MODE" != upstream ] ;;   # ELRepo / self-built kernels are not patched automatically
     *) return 1 ;;
   esac
 }
 
 # zypper exit codes 100-103 are informational (updates available, reboot needed, ...), treat as success
 zypper_ok() { [ "$1" -eq 0 ] || { [ "$1" -ge 100 ] && [ "$1" -le 103 ]; }; }
 zypper_run() {      # kernel packages only: proceed without asking
   local rc
   run $SUDO zypper --non-interactive "$@"; rc=$?
   zypper_ok "$rc"
 }
 zypper_ask() {      # full system upgrade (dup): may remove packages, so the user confirms
   local rc
   run $SUDO zypper "$@"; rc=$?
   zypper_ok "$rc"
 }
 
 # Upgrade only the installed linux-* packages (metapackages pull in the new ABI kernel).
 #  - --no-remove: stop if other packages would have to be removed
 #  - 'apt-get install' marks the named packages as manually installed, so restore the ones that
 #    were automatic, letting 'apt autoremove' keep cleaning up old kernels
 #  - Proxmox: dist-upgrade as Proxmox recommends, without -y so the user reviews any removals
 patch_apt() {
   local pkgs="" autos="" st pkg a meta=0
   local opts="-o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold"
   run $SUDO apt-get update || return 1
   if [ "$FAMILY" = proxmox ]; then
     run $SUDO env DEBIAN_FRONTEND=noninteractive apt-get $opts dist-upgrade
     return
   fi
   while read -r st pkg; do
     case $st in ii*) ;; *) continue ;; esac
     pkgs="$pkgs $pkg"
     case $pkg in linux-image-[a-z]*) meta=1 ;; esac
   done <<EOF
 $(dpkg-query -W -f='${db:Status-Abbrev} ${Package}\n' 'linux-*' 2>/dev/null)
 EOF
   if [ -z "$pkgs" ]; then
     line "No installed linux-* kernel packages found."; return 1
   fi
   while read -r a; do
     case "$pkgs " in *" $a "*) autos="$autos $a" ;; esac
   done <<EOF
 $(apt-mark showauto 2>/dev/null)
 EOF
   run $SUDO env DEBIAN_FRONTEND=noninteractive apt-get -y $opts --no-remove install --only-upgrade $pkgs || return 1
   [ -n "$autos" ] && run $SUDO apt-mark auto $autos >/dev/null
   # On Debian without a kernel metapackage the new ABI kernel never arrives, so install it
   if [ "$FAMILY" = debian ] && [ "$meta" = 0 ]; then
     run $SUDO env DEBIAN_FRONTEND=noninteractive apt-get -y $opts --no-remove install "linux-image-$(dpkg --print-architecture)"
   fi
 }
 
 # The AlmaLinux advisory method. The testing repo is enabled only for this run, and the repo
 # package is removed afterwards so regular updates never mix in testing packages.
 patch_alma() {
   local rc
   run $SUDO dnf clean metadata && run $SUDO dnf -y update 'kernel*' || return 1
   installed_fix_ready && return 0
   line "The fixed kernel is not in the regular repositories yet; installing from almalinux-testing. (AlmaLinux advisory method)"
   run $SUDO dnf -y install almalinux-release-testing || return 1
   run $SUDO dnf -y update 'kernel*' --enablerepo=almalinux-testing; rc=$?
   run $SUDO dnf -y remove almalinux-release-testing ||
     note "Could not remove almalinux-release-testing. Check /etc/yum.repos.d/ to make sure the testing repo is not enabled."
   return $rc
 }
 
 # Full system upgrades (pacman -Syu, zypper dup, apk upgrade, transactional-update dup) may remove
 # or replace packages, so their confirmation prompt is kept. Kernel-only upgrades use -y.
 patch_now() {
   local pm=dnf
   case $OS_MAJ_NUM in [1-7]) pm=yum ;; esac
   case $FAMILY in
     alma)       patch_alma ;;
     kitten|rhel|centos|rocky|rhelclone|oracle)
                 run $SUDO $pm -y update 'kernel*' ;;
     amazon)
       if [ "$OS_VER" = 2 ]; then run $SUDO yum -y update kernel
       else run $SUDO dnf -y update "${R_PKG:-kernel}" --releasever=latest; fi ;;
     fedora)     run $SUDO dnf -y upgrade --refresh 'kernel*' ;;
     debian|debianlike|ubuntu|proxmox) patch_apt ;;
     sles|leap)  zypper_run refresh && zypper_run update "kernel-${KREL##*-}" ;;
     slemicro)   run $SUDO transactional-update --non-interactive patch ;;
     microos)    run $SUDO transactional-update --interactive dup ;;
     tumbleweed) zypper_run refresh && zypper_ask dup ;;
     arch)       run $SUDO pacman -Syu ;;
     alpine)     run $SUDO apk -U --interactive upgrade ;;
     *)          return 1 ;;
   esac
 }
 
 # With too little free space in /boot, creating the new kernel/initramfs can half-fail while the
 # default boot entry still changes
 boot_space_ok() {
   local avail
   have df || return 0
   avail=$(df -Pk /boot 2>/dev/null | awk 'NR == 2 { print $4 }')
   case $avail in ''|*[!0-9]*) return 0 ;; esac
   [ "$avail" -ge 102400 ] && return 0
   line "${C_RED}Only $((avail / 1024))MB free in /boot; installing a new kernel may fail, so patching stops here.${C_OFF}"
   cmt "Remove old kernels, e.g.: sudo dnf remove --oldinstallonly kernel   /   sudo apt autoremove --purge"
   return 1
 }
 
 # After transactional-update: does the next boot snapshot (btrfs default subvolume) contain a fixed kernel?
 snapshot_fix_ready() {
   local out n root k list="" tab pick
   REBOOT_TARGET=""; REBOOT_KREL=""
   have btrfs || return 1
   out=$($SUDO btrfs subvolume get-default / 2>/dev/null) || return 1
   case $out in */.snapshots/*/snapshot*) ;; *) return 1 ;; esac
   n=${out##*/.snapshots/}; n=${n%%/*}
   case $n in ''|*[!0-9]*) return 1 ;; esac
   root=/.snapshots/$n/snapshot
   if [ "$FAMILY" = slemicro ]; then
     $SUDO rpm --root "$root" -q --changelog "kernel-${KREL##*-}" 2>/dev/null | has_fix_text || return 1
   else
     tab=$(printf '\t')
     for k in $($SUDO ls "$root/usr/lib/modules" 2>/dev/null); do list="$list$k$tab$k
 "; done
     pick=$(printf '%s' "$list" | LC_ALL=C awk -v op=pick -v mode=rpm -v ref="" "$AWK_VERCMP")
     k=${pick%%"$tab"*}
     [ -n "$k" ] || return 1
     upstream_eval "$k"; [ "$E_STATUS" = fixed ] || return 1
   fi
   REBOOT_TARGET="snapshot $n"
 }
 
 # After patching, will a reboot come up on a fixed kernel? (in-place replacement first, then next boot kernel)
 reboot_fix_ready() {
   case $FAMILY in slemicro|microos) snapshot_fix_ready; return ;; esac
   evaluate_kernel "$KREL" "$RUN_DVER"
   if [ "$E_INPLACE" = 1 ]; then
     REBOOT_KREL=$KREL; REBOOT_TARGET="$KREL (package replaced under the same name after boot)"
     return 0
   fi
   installed_fix_ready
 }
 
 show_default_kernel() {
   local d
   have grubby || return 0
   d=$($SUDO grubby --default-kernel 2>/dev/null) || return 0
   [ -n "$d" ] && kv "Default boot kernel" "$d"
 }
 
 # Without grubby, when GRUB_DEFAULT is not 0 (first entry = newest kernel) the next boot kernel is uncertain
 grub_default_custom() {
   local l v=""
   have grubby && return 1
   [ -r /etc/default/grub ] || return 1
   while IFS= read -r l; do case $l in GRUB_DEFAULT=*) v=${l#GRUB_DEFAULT=} ;; esac; done < /etc/default/grub
   v=${v#\"}; v=${v%\"}; v=${v#\'}; v=${v%\'}
   case $v in ''|0) return 1 ;; esac
   GRUB_DEFAULT_VAL=$v
 }
 
 do_reboot() {
   local ans grub_custom=0
   grub_default_custom && grub_custom=1
   # On a virtualization host, with a GRUB setup that makes the next boot kernel uncertain, or in a
   # shell without timed input (read -t), ask for a typed 'yes' instead of a countdown
   if [ "$HV_HOST" = 1 ] || [ "$grub_custom" = 1 ] || [ -z "${BASH_VERSION:-}" ]; then
     if [ "$HV_HOST" = 1 ]; then
       line "${C_YEL}This is a virtualization host. Rebooting stops every running VM.${C_OFF}"
       line "If possible, migrate the guests to another host or shut them down first."
     fi
     if [ "$grub_custom" = 1 ]; then
       line "${C_YEL}GRUB_DEFAULT=$GRUB_DEFAULT_VAL, so the next boot may not use the newest kernel. Check the boot menu settings.${C_OFF}"
     fi
     printf '  Type yes to reboot now: '
     read -r ans || ans=""
     if [ "$ans" != yes ]; then
       line "Reboot cancelled. Run 'sudo reboot' when you are ready."
       return 1
     fi
   else
     printf '  Rebooting in 10 seconds. Press Enter to cancel... '
     # Reboot only when the timer runs out (exit code > 128). Enter, Ctrl-D (EOF) or errors cancel.
     read -r -t 10 ans
     if [ $? -le 128 ]; then
       printf '\n'
       line "Reboot cancelled. Run 'sudo reboot' when you are ready."
       return 1
     fi
     printf '\n'
   fi
   line "Rebooting. Run this script again after boot to confirm the result."
   run $SUDO reboot
 }
 
 auto_patch() {
   setup_sudo || { show_manual; return; }
   if [ "$FINAL" != reboot ]; then
     section "Patching"
     note "Updating kernel packages. sudo may ask for your password."
     boot_space_ok || { show_manual; return; }
     if ! patch_now; then
       line "${C_RED}The package update failed. Check the output above and continue with the manual steps below.${C_OFF}"
       show_manual
       return
     fi
     if reboot_fix_ready; then
       FINAL=reboot
       line "${C_GRN}Fixed kernel confirmed for the next boot: $REBOOT_TARGET${C_OFF}"
     else
       line "The update finished, but the fix for $CVE could not be confirmed in the next boot kernel. Not rebooting."
       if [ -n "${NB_ALT:-}" ]; then
         line "The fixed kernel $NB_ALT is installed but is not the default boot kernel:"
         cmd "sudo grubby --set-default /boot/vmlinuz-$NB_ALT && sudo reboot"
       else
         line "The distribution may not have released a fixed kernel yet."
       fi
       show_manual
       return
     fi
   fi
   # Never reboot into a kernel whose boot files are missing (dracut/initramfs generation failure etc.)
   if [ -n "${REBOOT_KREL:-}" ] && ! boot_files_ok "$REBOOT_KREL"; then
     line "${C_RED}The kernel image or initramfs for $REBOOT_KREL is missing, so the automatic reboot stops here.${C_OFF}"
     cmt "Rebuild the initramfs: sudo dracut -f --kver $REBOOT_KREL   /   sudo update-initramfs -u -k $REBOOT_KREL"
     return
   fi
   section "Reboot"
   show_default_kernel
   do_reboot
 }
 
 choose_action() {
   local choice label
   case $FINAL in
     reboot)          label="Reboot now (apply the installed fixed kernel)" ;;
     pending|unknown) label="Try updating now (install and reboot if a fixed kernel is out)" ;;
     *)               label="Patch now (install the fixed kernel and reboot)" ;;
   esac
   can_autopatch || label="Patch now — automatic patching is not supported on this system"
 
   section "Choose the next step"
   if [ -n "$VIRT" ]; then
     line "${C_YEL}This system is a VM guest ($VIRT). Patching the guest does not protect the host,${C_OFF}"
     line "${C_YEL}so run this script on the host OS as well and patch it there.${C_OFF}"
     printf '\n'
   fi
   line "1. $label"
   line "2. Patch manually later (show the commands)"
   line "3. Exit"
   while :; do
     printf '\n  Choice [1-3]: '
     read -r choice || { printf '\n'; return; }
     case $choice in
       1)
         if can_autopatch; then
           auto_patch
         else
           line "This distribution/kernel cannot be patched automatically. Follow the manual steps below."
           show_manual
         fi
         return ;;
       2) show_manual; return ;;
       3) line "Exiting."; return ;;
       *) line "Enter 1, 2 or 3." ;;
     esac
   done
 }
 
 print_header() {
   printf '%s' "$C_BLU"
   printf '==================================================================\n'
   printf ' %s (PwnEscape) Linux kernel vulnerability scanner\n' "$CVE"
   printf ' Missing IPv4 checksum_start validation → guest VM can escape to the host\n'
   printf ' CVSS 9.3 Critical · every kernel since 2.6.27 · fix commit %s\n' "$FIX_COMMIT"
   printf '==================================================================\n'
   printf '%s' "$C_OFF"
 }
 
 print_table_rows() {  # $1=table name $2=row prefix
   local br cmp disp adv pkg
   while IFS='|' read -r br cmp disp adv pkg; do
     [ -n "$br" ] && line "$2$disp or later ($adv)"
   done <<EOF
 $(vendor_table "$1")
 EOF
 }
 
 print_matrix() {
   printf '%s%s status and fixed versions by distribution (as of %s)%s\n' "$C_BLU" "$CVE" "$DATA_DATE" "$C_OFF"
   section "Upstream kernel (kernel.org)"
   line "Affected: every kernel since 2.6.27 / fix commit $FIX_COMMIT"
   line "Fixed: $UPSTREAM_TEXT"
   line "Other branches (5.4, 6.7-6.11, 6.13-6.17, 7.0, 7.1, ...) are end of life — move to a supported branch"
   section "AlmaLinux — fixed (2026-10-16, almalinux-testing repo)"
   print_table_rows alma8 "8:  "
   print_table_rows alma9 "9:  "
   print_table_rows alma10 "10: "
   line "Kitten 10: included in the next regular kernel update (no separate build)"
   section "Red Hat Enterprise Linux 7 / 8 / 9 / 10 — affected · no fix yet"
   line "Red Hat CVSS 8.8 (Important), no mitigation, both kernel and kernel-rt affected"
   section "Rocky Linux · CentOS Stream · other RHEL compatibles — no fixed kernel published"
   line "Expected to follow the RHEL fix (including Oracle Linux RHCK)"
   section "Oracle Linux UEK — fixed (2026-10-16)"
   print_table_rows uek ""
   section "Amazon Linux 2 — fixed"
   print_table_rows al2 ""
   section "Amazon Linux 2023 — fixed"
   print_table_rows al2023 ""
   line "AWS states that the EC2 · Lambda · Fargate host infrastructure is not affected"
   section "Debian"
   line "bookworm (12):  6.1.190-1 or later (DLA-4841-1, bookworm-security)"
   line "trixie (13):    6.12.113-1 or later (DSA-6568-1, trixie-security)"
   line "forky / sid:    7.2.11-1 or later"
   line "bullseye (11) and older: not tracked by Debian security (end of life)"
   section "Ubuntu — no fix yet"
   line "14.04 - 26.04: every kernel package (linux, -aws, -azure, -gcp, -oracle, -hwe, ...) 'Needs evaluation'"
   section "SUSE / openSUSE"
   line "SLES 12 SP5 · 15 SP4-SP7 · 16.x, SLE Micro 5.3-5.5 · 6.x, Leap 16: affected · no fix yet (Pending)"
   line "openSUSE Leap 15.x, SLES 15 SP1-SP3, SLE Micro 5.0-5.2: end of life"
   section "Fedora · Arch · openSUSE Tumbleweed · Alpine · Gentoo, ..."
   line "Distribution kernels track upstream stable, so the upstream fixed versions above apply"
   printf '\n'
   note "Vendor advisories keep changing. Check each distribution's security tracker for the latest status."
 }
 
 # -----------------------------------------------------------------------------
 main() {
   parse_args "$@"
   setup_colors
   if [ "$LIST_ONLY" = 1 ]; then print_matrix; exit 0; fi
 
   if [ "$OFFLINE" = 0 ]; then
     # Read the same values as uname -r / -v straight from /proc (no subprocess)
     if [ -r /proc/sys/kernel/osrelease ] && [ -r /proc/sys/kernel/version ]; then
       read -r KREL < /proc/sys/kernel/osrelease
       read -r KVER < /proc/sys/kernel/version
     else
       [ "$(uname -s)" = Linux ] ||
         die "Run this on Linux. (To judge another server's values use --uname-r / --uname-v / --os-release)"
       KREL=$(uname -r); KVER=$(uname -v)
     fi
   fi
   RUN_DVER=""
   case $KVER in *" Debian "*) RUN_DVER=${KVER#* Debian }; RUN_DVER=${RUN_DVER%% *} ;; esac
 
   detect_os
   VIRT=""; CTR=""; HV_HOST=0
   [ "$OFFLINE" = 0 ] && detect_virt_container
   case $FAMILY in wsl|wsl1) VIRT="" ;; esac   # the WSL host is Windows, so the 'patch the Linux host' advice does not apply
   # The running Debian kernel version comes only from uname -v. The package version on disk may have changed since boot.
 
   print_header
   section "System information"
   kv "Distribution" "${OS_NAME:-unknown} [${OS_ID:-?} ${OS_VER:-?}]"
   kv "Running kernel" "$KREL"
   [ -n "$RUN_DVER" ] && kv "Debian kernel package" "$RUN_DVER"
   if [ "$OFFLINE" = 1 ]; then
     kv "Check mode" "judging supplied values (local checks skipped)"
   elif [ "$FAMILY" = wsl ]; then
     kv "Virtualization" "WSL2 (running on Windows Hyper-V)"
   elif [ -n "$VIRT" ]; then
     kv "Virtualization" "VM guest ($VIRT)"
   else
     kv "Virtualization" "physical server or not detected"
   fi
   kv "Method" "$(family_label)"
 
   if [ -n "$CTR" ]; then
     section "Verdict"
     kv "Status" "$(status_label unknown)"
     line "Running inside a container ($CTR). Containers share the host kernel, so the"
     line "container image's distribution cannot be used for the verdict. Run this on the host."
     line "If you cannot reach the host directly, judge the host's values instead:"
     cmd "bash $0 --uname-r '<host uname -r>' --uname-v '<host uname -v>' --os-release <copy of the host os-release>"
     exit 4
   fi
 
   evaluate_kernel "$KREL" "$RUN_DVER"
   R_STATUS=$E_STATUS R_FIXED=$E_FIXED R_BASIS=$E_BASIS R_ADV=$E_ADV R_PKG=$E_PKG R_MODE=$E_MODE R_INPLACE=$E_INPLACE
   FINAL=$R_STATUS; LP_NAME=""; REBOOT_TARGET=""; REBOOT_KREL=""; NEXT_WARN=""; NB_ALT=""
   # WSL never boots a distribution kernel, so installed-kernel and livepatch checks are meaningless there
   if [ "$OFFLINE" = 0 ] && [ "$FAMILY" != wsl ] && [ "$FAMILY" != wsl1 ]; then
     case $R_STATUS in
       vulnerable|pending|eol|unknown)
         if livepatch_has_fix; then
           FINAL=livepatched
         elif [ "$R_INPLACE" = 1 ]; then
           FINAL=reboot; REBOOT_KREL=$KREL; REBOOT_TARGET="$KREL (package replaced under the same name after boot)"
         elif installed_fix_ready; then
           FINAL=reboot
         fi ;;
       fixed)
         # Safe now, but if the next boot kernel is not fixed, the system becomes vulnerable again on reboot
         next_boot_eval
         if [ -n "$NB_KREL" ]; then
           case $NB_STATUS in fixed|unaffected) ;; *) NEXT_WARN=$NB_KREL ;; esac
         fi ;;
     esac
   fi
 
   section "Verdict"
   kv "Status" "$(status_label "$FINAL")"
   kv "Basis" "$R_BASIS"
   [ -n "$R_FIXED" ] && kv "Fixed version" "$R_FIXED${R_ADV:+ ($R_ADV)}"
   [ "$FINAL" = livepatched ] && kv "Livepatch" "$LP_NAME"
   [ "$FINAL" = reboot ] && kv "Fixed kernel for next boot" "$REBOOT_TARGET"
   [ -n "$NEXT_WARN" ] &&
     kv "Warning" "${C_YEL}The next boot kernel $NEXT_WARN is not fixed. Rebooting may make the system vulnerable again.${C_OFF}"
   if [ "$FINAL" != reboot ] && [ -n "$NB_ALT" ]; then
     kv "Note" "the fixed kernel $NB_ALT is installed but is not the default boot kernel → sudo grubby --set-default /boot/vmlinuz-$NB_ALT"
   fi
 
   if [ "$OFFLINE" = 0 ]; then
     section "Exposure"
     check_exposure
   fi
 
   case $FINAL in
     fixed|unaffected|livepatched)
       section "Remediation"
       print_remedy "$FINAL"
       print_refs_section ;;
     *)
       # Show the menu only when both input and output are a terminal (with output redirected to a
       # file the prompt would be invisible and the script would seem to hang)
       if [ "$OFFLINE" = 0 ] && [ -t 0 ] && [ -t 1 ]; then choose_action; else show_manual; fi ;;
   esac
 
   case $FINAL in
     fixed|unaffected|livepatched) exit 0 ;;
     vulnerable)                   exit 1 ;;
     reboot)                       exit 2 ;;
     pending|eol)                  exit 3 ;;
     *)                            exit 4 ;;
   esac
 }
 
 main "$@"