based on the Linux 6.6.129 LTS kernel基于 Linux 6.6.129 LTS 内核

immkernel

Q: Did you modify the kernel source code?

No. Pure upstream Linux 6.6.129 — the immunity comes from configuration alone.

Q: Do apps need configuration changes after install?

The default immkernel-lite needs no changes. immkernel-pro will require some tuning, but it isn't released yet — nothing to worry about, just run the one-click install.

Q: Does it immunize against every CVE and rootkit backdoor?

Definitely not all. But it covers the vast majority, orders of magnitude more than a stock kernel. Unless your bar is exceptionally high, this is enough to let you sit back and watch the AI-driven CVE storm without flinching.

immune kernel — immune to rootkits, backdoors, exploits免疫内核 — 抵御 rootkit、后门、漏洞利用

Tired of upgrading systems and running incident response behind every AI-found exploit. Counter AI with immunity, stay ahead of the bugs, stay ahead of the hackers.拒绝苦哈哈的跟在AI挖漏洞后面升级系统和应急响应。以免疫对抗 AI，走在漏洞前面，走在黑客前面。

For适合 lazy sysadmins懒得折腾的运维 change-resistant quant trading systems拒绝变更的量化交易系统 sensitive servers that need immunity from 0-day exploits and rootkit backdoors需要免疫 0day 漏洞和各种 rootkit 后门的敏感服务器 long-running servers长期稳定运行的服务器

one step install · set and forget · relax一键安装、一劳永逸、一把躺平

curl -fsSL https://immkernel.org/immkernel.sh | bash curl -fsSL https://immkernel.org/immkernel_cn.sh | bash

Continuous Validation持续验证

Private validation farm re-tests stock 6.6.129 · lite · pro · enterprise. Public counts only here — licensed detail, short videos, and probes live on the Continuous Validation Matrix.私有验证场持续复测 stock 6.6.129 · lite · pro · enterprise。此处仅公开计数；明细、短视频与探针见持续验证矩阵页（许可证门闩）。

Tracked: 13 CVE/LPE · 2 near-RCE/RCE · 2 backdoor classes · 7 rootkit insertion classes · 7 attacker techniques.追踪：13 CVE/LPE · 2 近 RCE/RCE · 2 后门类 · 7 rootkit 插入类 · 7 攻击者技术类。

See Continuous Validation Matrix →查看持续验证矩阵 →

Distro compatibility发行版兼容性

Amazon Linux 2 / 2023 Debian 12 / 13 Ubuntu 22.04 / 24.04 LTS Alibaba Cloud Linux 3 TencentOS Server 3 OpenCloudOS 9

App compatibility应用兼容性

WebWeb 服务: nginx · Apache httpd · Caddy · HAProxy · Traefik · lighttpd
Database数据库: MySQL · MariaDB · PostgreSQL · Redis · MongoDB · ClickHouse · Elasticsearch · TiDB
Middleware中间件: Kafka · RabbitMQ · NATS · Pulsar · Memcached · ZooKeeper
Runtime运行时: JVM · Go · Python · Node.js · Rust
Observability可观测性: Prometheus · Grafana · Loki · Jaeger · OpenTelemetry Collector
Security安全工具: JumpServer · Teleport · HashiCorp Vault · Casdoor · Suricata · Zeek · Splunk
Container容器: Docker · Podman · Kubernetes · containerd · runc

Performance性能

immkernel vs stock Ubuntu, Debian, and Amazon Linux 2023 kernels — fio · sysbench · wrk · redis-benchmark · pgbench.immkernel vs Ubuntu、Debian、Amazon Linux 2023 默认内核 — fio · sysbench · wrk · redis-benchmark · pgbench。

Report coming.报告生成中。

Variants版本对比

lite = free path elimination · pro = paid attack-surface reduction · enterprise = rootkit/backdoor immunity + exploit mitigation + centralized fleet management · SSO · PAM.lite = 免费路径消除 · pro = 付费攻击面削减 · enterprise（企业版）= rootkit/后门免疫 + 利用缓解 + 集中舰队管理 · SSO · PAM。

	immkernel-lite	immkernel-pro	immkernel-enterprise
Pricing定价	Free免费	Paid付费	Premium高价
CVE path eliminationCVE 路径消除	Partial部分	Most绝大部分	Near-complete接近完备
Attack-surface reduction攻击面削减	Limited有限	Strong强	Strong强
Rootkit / backdoor immunityrootkit / 后门免疫	—	Partial–most部分–大部分	Near-complete接近完备
Exploit mitigation (grsecurity/PaX)利用缓解（grsecurity/PaX）	—	—	✓
Centralized fleet management · SSO · PAM集中舰队管理 · SSO · PAM	—	—	✓
Docker / eBPF supportDocker / eBPF 支持	✓	—	—
Release发布状态	Released已发布	Unreleased未发布	On roadmap规划中

FAQ

Did you modify the kernel source code?你修改了内核代码吗？

For released lite: no. Pure upstream Linux 6.6.129 — immunity comes from configuration. Higher tiers may add further hardening (including grsecurity/PaX on enterprise).已发布的 lite：没有。基于纯净的 6.6.129，免疫来自配置。更高档可能叠加额外加固（enterprise / 企业版含 grsecurity/PaX）。

Are there known CVEs in this kernel version?这个内核版本有漏洞吗？

Yes — the code paths for copy.fail and dirtyfrag are still present, but the kernel is already immune. We deliberately stay on this version. Try to exploit it.有。copy.fail 和 dirtyfrag 漏洞相关代码都在，但已经免疫了。我们故意不用最新版本，大家可以打打看。

Do apps need configuration changes after install?装完之后应用要改配置吗？

The default immkernel-lite needs no changes. immkernel-pro will require some tuning, but it isn't released yet — nothing to worry about, just run the one-click install.默认的 immkernel-lite 不需要改，pro 需要一些微调，但还没放出来，所以不必担心，一键安装就是了。

How do I roll this out without causing trouble?怎么用这个内核不捅娄子？

Phased rollout, always. Test environments first, production second. Edge services before core ones. Move with intent, not in haste.务必记得灰度部署。先在测试环境部署，再到正式环境部署；先在边缘业务部署，再到核心业务部署。目标清晰但不着急不冒进。

A service won't start. What do I do?我有服务跑不起来怎么办？

First, paste the error log into an AI assistant for triage. If you're still stuck, email me — but include the actual error message and a description of what you're trying to do, or I can't help either.先把错误信息给 AI 帮你分析一下。如果还搞不定，发邮件给我，我帮你看看，但务必带上完整错误信息和描述，否则我也爱莫能助。

Does it immunize against every CVE and rootkit backdoor?能免疫所有漏洞和 rootkit 后门吗？

No. lite covers config-based path elimination for a subset of CVEs — not the vast majority, and not rootkit/backdoor immunity. Broader CVE / unprivileged LPE class mitigation is the Pro story; near-complete rootkit/backdoor immunity and exploit mitigation is enterprise.不能。lite 只做基于配置的路径消除（子集 CVE），不是绝大多数，也不宣称 rootkit/后门免疫。更广的 CVE / 无特权 LPE 类缓解是 Pro；接近完备的 rootkit/后门免疫与利用缓解是 enterprise（企业版）。

Will you publish a list of the rootkits and backdoors it's immune to?免疫的 rootkit 和后门会给清单吗？

Publicly we publish counts and insertion-class framework names (see /validation). Sample-level results and videos are enterprise-license only.公开只公布数量与插入类框架名（见 /validation）。样本级结果与视频仅 enterprise（企业版）许可证可见。

Is immkernel free? Do you take money?immkernel 免费吗？收不收钱？

Freemium. lite is free forever (one-click install). pro and enterprise are paid. Continuous Validation detail is on /validation and gated by license.Freemium。lite 永久免费（一键安装）。pro 与 enterprise（企业版）付费。除免费 lite 明细表外，持续验证明细见 /validation，按许可证门闩。

What does enterprise add beyond rootkit immunity?enterprise（企业版）在 rootkit 免疫之外还提供什么？

enterprise adds exploit mitigation (grsecurity/PaX) plus centralized fleet management with SSO and PAM integration for enterprise identity and privileged-access workflows.enterprise（企业版）叠加利用缓解（grsecurity/PaX），并提供集中舰队管理能力，以及 SSO 与 PAM 接入，面向企业身份与特权访问流程。

How do I combine immkernel with other security tools?组合拳怎么打？

Pair immkernel with an EDR/HIDS for genuine 1+1>2 synergy. Because the kernel has shut down most of the routes attackers use to take over a system, your security tooling sees a cleaner picture — fewer rootkit-induced blind spots, more authentic signal.在 immkernel 安全免疫内核的保护下结合 EDR/HIDS，让我们占据更有利的位置，1+1>2。因为内核堵住了黑客成为系统主宰的好些路子，安全工具的结果更可靠、更真实。

Will you publish the kernel config?会公开内核配置文件吗？

No. If you're worried about security, the kernel source is already public — have an AI download and analyze it for you. Whether what's in here counts as novel is for you to judge. But this thing was built on my late nights, distilling 20+ years of hands-on Linux offensive and defensive security work. In the AI era CVEs land faster and exploits land faster still, so I'm releasing this as my contribution back to the open-source community, with no plans to monetize. If you have the skills and the time, you can absolutely build your own. I'm just not making it easy for the rebrand-and-claim crowd.不会。如果你担心安全问题，内核代码本来就是公开的，你可以让 AI 下载研究。有没技术含量见仁见智——但这玩意是我熬夜搞出来的，也承载了我在 Linux 安全攻防 20 多年的实战经验。AI 时代漏洞只会越出越多，exploit 越出越快，作为对开源社区的反哺发出来，也不打算盈利。你有能力和时间的话，我相信你也可以；但我不惯着谣谣领先和自主可控们。

Will you keep maintaining and iterating?会继续维护和迭代吗？

Yes, but mostly on compatibility and stability. The kernel version stays locked at 6.6.129 unless an LPE breaks immunity or a stability / compatibility issue forces a bump. The whole point is no upgrades, no churn — never go looking for trouble.会，但更多是在兼容性和稳定性上迭代。如果这个内核被 LPE 漏洞打掉了，或者出现稳定性/兼容性问题，会升级；否则版本就锁定在 6.6.129。因为我们的核心目标就是不升级不折腾，没事绝对不自己找事。

Is the install process safe? What about supply-chain risk?安装过程安全吗？有供应链风险吗？

GPG signatures and SHA256 checksums are verified end-to-end. I keep the install chain as simple as I can. Because no kernel source has been modified, there is no contributor pipeline to compromise — poisoning the supply chain is materially harder than for projects shipping custom code.装的时候有 GPG 签名和 SHA256 校验，我会尽量让整个过程简单又安全。因为没有改任何内核代码，所以也没有代码贡献者通道，投毒不那么容易。

My boss is worried immkernel might have a backdoor. What now?老板担心 immkernel 有后门怎么办？

Up to you. If you're a tier-one player, just have an AI study the source — I've revealed most of the thinking, kept a bit hidden, but nothing stops you from rolling your own. If you're not tier-one, AND you worry about immkernel's security, AND you think CVE exposure would hurt you, AND you don't want to patch CVEs yourself, AND you want it all for free — mate, that takes money. But I don't take money and I don't accept donations either. So figure it out yourself.看你自己选。如果你是头部玩家，让 AI 研究就好——思想我已经透露了一部分，虽然还藏了一点，这也不妨碍你自己搞一套。如果你不是头部玩家，又担心 immkernel 的安全问题，又觉得漏洞对你影响大，又不想自己修漏洞，这既要又要还要更要的逻辑——老铁，得掏钱。但我不要钱也不接受任何形式的捐赠，所以自己想办法吧。