[PATCH 2/2] kernel/kallsyms: Prevent bypassing of kprobes blacklist
From: Elly I. Esparza
Date: Wed Feb 18 2026 - 09:48:42 EST
Kprobes can be used to get the adress of kallsyms_lookup_name() providing
access to blacklisted symbols.
Add kallsyms_lookup_name() to kprobes blacklist.
Signed-off-by: Elly I. Esparza <ellyesparza8@xxxxxxxxx>
---
kernel/kallsyms.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 1e7635864124..13a7c0fdb5da 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -234,6 +234,7 @@ unsigned long kallsyms_lookup_name(const char *name)
return module_kallsyms_lookup_name(name);
}
+NOKPROBE_SYMBOL(kallsyms_lookup_name)
/*
* Iterate over all symbols in vmlinux. For symbols from modules use
--
2.43.0