Tell HN: CrowdStrike Falcon users, check for excess KernelModuleArchiveExt files

Re:Tell HN: CrowdStrike Falcon users, check for excess Kerne... by broknbottle on Friday October 10, 2025 @05:03PM (#45543765)

I’m assuming this affects their older kernel module variant. Switch to their bpf version if you must use this snake oil

[ Parent | on HN ]

Re:Tell HN: CrowdStrike Falcon users, check for excess Kerne... by CaliforniaKarl on Friday October 10, 2025 @05:27PM (#45543965)

Unfortunately, no.

From what I've seen, CrowdStrike Falcon installations contain both the BPF components and the kernel module. (I think you can tell which one you're using: if falcon-sensor is running, it's the kernel module; if falcon-sensor-bpf is running, it's BPF.)

I manage systems running Debian, Ubuntu, RHEL, and Rocky. Newer and older, kernel and BPF. And unfortunately, this issue is present across all of them.

[ Parent | on HN ]