Unverified50% confidenceFactExact time
Linux内核包含超过2800万行代码，容器共享同一宿主内核，内核漏洞可能成为逃逸路径
1
Sources
50%
Confidence
Long-term
Relevance
8/20/2026
First Seen
Sources
Related Claims
UnverifiedIn the Linux kernel, each network socket is represented as a file descriptor; when a process forks a child process, the child inherits the parent's file descriptor table via a reference-counting mechanism, causing port leaks to survive across processes.69% similarUnverifiedThe container escape vulnerability CVE-2019-5736 (runc vulnerability) was discovered because all containers share the same kernel66% similarUnverifiedLinux内核曾因编译器优化掉空指针检查而引入安全漏洞CVE-2009-189764% similarUnverifiedAs long as any process holds a reference to a socket file descriptor, the corresponding socket will not be reclaimed by the kernel—this is the underlying mechanism by which port leaks can survive across processes.60% similarUnverified多个核心同时修改同一缓存行内的不同独立变量会因缓存一致性协议导致缓存行反复失效和传输，这称为伪共享59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/777416API
curl https://kongchang.com/api/v1/knowledge/claims/777416MCP
get_claim(id=777416)