<story><title>CrowdStrike&apos;s Falcon Sensor also linked to Linux kernel panics and crashes</title><url>https://www.theregister.com/2024/07/21/crowdstrike_linux_crashes_restoration_tools/</url></story><parent_chain></parent_chain><comment><author>roblabla</author><text>This is some very poor journalism. The linux issues are so, so very different from the windows BSOD issue.&lt;p&gt;The redhat kernel panics were caused by a bug in the kernel ebpf implementation, likely a regression introduced by a rhel-specific patch. Blaming crowdstrike for this is stupid (just like blaming microsoft for the crowdstrike bsod is stupid).&lt;p&gt;For background, I also work on a product using eBPFs, and had kernel updates cause kernel panics in my eBPF probes.&lt;p&gt;In my case, the panic happened because the kernel decided to change an LSM hook interface, adding a new argument in front of the others. When the probe gets loaded, the kernel doesn’t typecheck the arguments, and so doesn’t realise the probe isn’t compatible with the new kernel. When the probe runs, shit happens and you end up with a kernel panic.&lt;p&gt;eBPF probes causing kernel panics are almost always indication of a kernel bug, not a bug in the ebpf vendor. There are exceptions of course (such as an ebpf denying access to a resource causing pid1 to crash). But they’re very few.</text></comment>
<story><title>CrowdStrike&apos;s Falcon Sensor also linked to Linux kernel panics and crashes</title><url>https://www.theregister.com/2024/07/21/crowdstrike_linux_crashes_restoration_tools/</url></story><parent_chain></parent_chain><comment><author>yftsui</author><text>Not surprising at all. My work issued MacBook top CPU time has been always `com.crowdstrike.falcon.Agent`, before Apple M1 released my Intel 2019 MacBook Pro can barely do any everyday task with that Agent running in the background. It crashed video calls, crashed the entire OS, I couldn&amp;#x27;t even smoothly type in an IDE back then.</text></comment>