Linux Kernel Security

Bad UVM Article by Ziyi Guo about escaping an NVidia Container Toolkit container by exploiting a logical bug in the NVidia GPU driver. medium.com/@guoziyi114/...

When Defenses Become Attack Surface: CVE-2026-20971, a Samsung Kernel UAF Article about analyzing exploitation primitives derived from a racy use-after-free bug in the Samsung PROCA (Process Authenticator) kernel module. lucidbitlabs.com/blog/when-de...

SoK: Take a Deep Step into Linux Kernel Hardening Effectiveness from the Offensive-Defensive Perspective Paper with analysis of 121 publicly documented exploits since 2015 and in-depth evaluation of 51 existing kernel defense mechanisms. www.ndss-symposium.org/ndss-paper/s...

PageJack in Action: CVE-2022-0995 exploit Article by Jean Vincent describing how a relatively old CVE can be exploited using the PageJack exploitation technique. blog.quarkslab.com/pagejack-in-...

21 Sept

CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel Paper by Dong-ok Kim, Juhyun Song, et al. documenting the steps for executing a cross-cache attacks for caches with min_partial >= cpu_partial_slabs. insuyun.github.io/pubs/2025/ki...

21 Sept

The paper also describes a fuzzing-based approach of finding target slab objects useful for exploitation.

16 Sept

Testing race conditions with memory access tracing and stack-based delay injection Article by Jann Horn about MAccConc — a KCOV-based tool for exploring possible kernel code interleavings of a multi-threaded program. Article: projectzero.google/2026/09/macc... Tool: github.com/googleprojec...

9 Sept

SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free Article about exploiting CVE-2026-64564 in the implementation of the Stream Control Transmission Protocol (SCTP). Authors exploited a UAF in the kmalloc-1k cache to gain root and escape a container. matrix.tencent.com/en/2026/08/0...

14 Aug

Gone in 60 Frames – USB Video Exploitation Article (and slides) by Alex Plaskett and Robert Herrera about fuzzing USB drivers with syzkaller and writing an exploit that gains code execution over USB on Ubuntu. Article: media.defcon.org/DEF%20CON%20... Slides: media.defcon.org/DEF%20CON%20...

11 Aug

IonStack part III: Rooting Android 17 with GhostLock Article about adapting the exploit of CVE-2026-43499 (kernel stack UAF) to Android. The researchers used KernelSnitch, ashmem fops overwriting, pipe_buffer corruption, and other tricks to perform LPE. nebusec.ai/research/ion...

23 July

I handed the epoll UAF to an agent Article by Guy Beck about using Claude for porting an exploit for an eventpoll vulnerability to Android. guysrd.github.io/epoll-uaf-ag...

21 July

IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years Article about exploiting a racy stack use-after-free in the futex implementation. The bug was used to pwn a kernelCTF instance. nebusec.ai/research/ion...

20 July

Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694) Article by Stan Shaw about exploiting a page OOB write bug in the FUSE subsystem by overwriting /etc/passwd in the page cache. cyberstan.co.uk/fuse-readdir...

18 July

Januscape: Guest-to-Host Escape in KVM/x86 Hyunwoo Kim published an article about a use-after-free vulnerability in the shadow MMU emulation of KVM/x86 (CVE-2026-53359). Both Intel (VMX) and AMD (SVM) code is affected. github.com/V4bel/Janusc...

18 July

The article only covers achieving a kernel crash via this bug, but the vulnerability can also be exploited to escape the guest VM. The author used this bug to pwn a kvmCTF instance.

8 July

ITScape: Guest-to-Host Escape in KVM/arm64 Article by Hyunwoo Kim about exploiting a race condition bug in the KVM driver on the arm64 architecture to escape the guest VM. github.com/V4bel/ITScape

3 July

Bad Epoll: The bug missed by Mythos Article by Jaeyoung Chung about exploiting CVE-2026-46242 — a race condition bug in the eventpoll subsystem. Jaeyoung exploited this bug to claim a kernelCTF entry, but the vulnerability also affects Android kernels. github.com/J-jaeyoung/b...

29 June

Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215) Stan Shaw published an article about exploiting UAF in a DRM GEM ioctl. The researcher reallocated freed memory as a pipe_buffer array to perform the Dirty Pipe attack. cyberstan.co.uk/drm-lpe-linux/

blog.exodusintel.comblog.exodusintel.com

25 June

Off By !: Exploiting a Use-after-Free in the Linux Kernel Oliver Sieber published write-up on CVE-2026-23111 in nftables, found in early 2025, patched upstream by other researchers in Feb 2026. Article describes exploiting this UAF on Debian and Ubuntu. blog.exodusintel.com/2026/06/08/o...

heyitsas.imCIFSwitch: a non-universal Linux local root vulnerabilityHarnessing LLMs into composing complex, multihop vulnerability chains to discover CVE-2026-46243

22 June

CIFSwitch: a non-universal Linux local root vulnerability Asim Viladi Oglu Manizada posted an article about a nice logic bug in the interaction between the kernel CIFS subsystem and the userspace cifs-utils package. heyitsas.im/posts/cifswi...

22 June

An attacker can forge a "cifs.spnego" key in Linux keyring to make the kernel run a root userspace helper to escalate privileges of the attacker's process.

10 June

Unix GC Remastered Article by Moe Acherir about the internals of the new Unix sockets garbage collector implementation and the analysis of CVE-2025-40214, which was used in a kernelCTF entry. mohandacherir.github.io/Qdiv7/posts/...

github.compocs/pintheft at main · v12-security/pocspoc it like it's hot. Contribute to v12-security/pocs development by creating an account on GitHub.

9 June

PinTheft Linux LPE Aaron Esau published an LPE exploit for a page double-free bug in the RDS zerocopy implementation, which can be turned into a page-cache overwrite through io_uring. github.com/v12-security...

3 June

Logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333) Article about a logical bug in the ptrace implementation that allows getting access to file descriptors of other processes and thus escalating privileges in certain scenarios. cdn2.qualys.com/advisory/202...

1 June

StepStone: LLM-Based GPU Kernel Driver Fuzzing via User-Space Libraries Paper by Xiaochen Zou et. al about using LLMs for generating syzkaller descriptions for fuzzing GPU drivers via their userspace libraries APIs. www.cs.ucr.edu/%7Ezhiyunq/p...

29 May

Privilege Escalation via a Page Use-After-Free in Qualcomm's AI Accelerator Linux Kernel Driver Article by Lukas Maar about exploiting a bug in the mmap handler of the QAIC driver that causes a page UAF. lukasmaar.github.io/posts/qaic-p...

22 May

Discovery & Validation in the Linux Kernel Three-part article by @sam4k.com about analyzing two vulnerabilities (in CAN sockets and FUSE) and attempting to use local LLMs to rediscover the bugs. Final part: bynar.io/blog/discove...

Recent Page Cache Corruption Bugs All stem from code paths that allow in-place overwrites of user-supplied input pages without verifying they are writable. This enables overwriting page cache and thus changing in-memory contents of read-only files. Selected links below ⬇️

View full thread

github.compocs/fragnesia at main · v12-security/pocspoc it like it's hot. Contribute to v12-security/pocs development by creating an account on GitHub.

Fragnesia (CVE-2026-46300) Original report: github.com/v12-security... Variant: github.com/v12-security...

github.comdisclosures/DirtyCBC at main · Delphos-Labs/disclosuresVulnerability disclosures and proof-of-concept exploits - Delphos-Labs/disclosures

DirtyCBC / DirtyDecrypt (CVE-2026-31635?) Write-up: github.com/Delphos-Labs... Another exploit: github.com/v12-security...

copy.failCopy Fail — 732 Bytes to RootCVE-2026-31431. 100% Reliable Linux LPE — no race, no per-distro offsets, page-cache write that bypasses on-disk file-integrity tools and crosses containers. Found by Xint Code.

Copy Fail (CVE-2026-31431) Announcement: copy.fail Better write-up: retr0.zip/blog/cve-202...

github.comGitHub - V4bel/dirtyfragContribute to V4bel/dirtyfrag development by creating an account on GitHub.

Dirty Frag (CVE-2026-43284 and CVE-2026-43500) Covers two independent vulnerabilities that do not require chaining. CVE-2026-43284 is alternatively titled Copy Fail 2. Original write-up: github.com/V4bel/dirtyf... Avoiding bruteforcing for CVE-2026-43500: www.linkedin.com/pulse/load-b...

a13xp0p0v.github.ioSome notes on the security properties of the pipe_buffer kernel objectMany exploits of Linux kernel vulnerabilities use the pipe_buffer kernel object to build strong exploit primitives. When I was experimenting with my personal project kernel-hack-drill, I discovered so...

28 Apr

Some notes on the security properties of the pipe_buffer kernel object Alexander Popov posted an article about a few experiments with the pipe_buffer kernel object within his kernel-hack-drill project. a13xp0p0v.github.io/2026/04/20/p...

28 Apr

Alexander described multiple pipe_buffer features relevant for kernel exploits that rely on this object.

23 Apr

Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs Hyunwoo Kim published an article describing a complicated exploit of a race condition caused by a misuse of the cancel_work_sync() kernel API in the network subsystem. v4bel.github.io/linux/2026/0...

youtube.comWalkthrough of an N-day Android GPU driver vulnerability - Angus, BSides Canberra 2025YouTube video by BSides Canberra

17 Apr

Walkthrough of an N-day Android GPU driver vulnerability Talk by Angus about analyzing CVE-2022-22706 — a logical bug in the Mali GPU driver that allows getting write access to read-only memory. www.youtube.com/watch?v=G71d...

16 Apr

From KernelSnitch to Practical msg_msg/pipe_buffer Heap KASLR Leaks Article by Lukas Maar about evaluating the KernelSnitch timing side-channel attack on a variety of systems, including Android. lukasmaar.github.io/posts/heap-k...

github.comGitHub - lukasmaar/kernelsnitchContribute to lukasmaar/kernelsnitch development by creating an account on GitHub.

16 Apr

The attack allows leaking addresses of exploitation-relevant kernel allocations. Lukas also published the source code for executing the attack. github.com/lukasmaar/ke...

14 Apr

Assessing Claude Mythos Preview’s cybersecurity capabilities Article by Nicholas Carlini et. al about the security research capabilities of the new Anthropic's LLM called Claude Mythos Preview. red.anthropic.com/2026/mythos-...

14 Apr

The LLM was used to discover multiple 0-days in the Linux kernel and also write privilege escalation exploits for a few previously known vulnerabilities; the article provides a detailed write-up for two such exploits.

13 Apr

slab: support for compiler-assisted type-based slab cache partitioning Marco Elver posted a kernel patch that provides an alternative mode to RANDOM_KMALLOC_CACHES called TYPED_KMALLOC_CACHES. lore.kernel.org/all/20260331...

13 Apr

The new mode leverages a Clang 22 feature called "allocation tokens". Unlike RANDOM_KMALLOC_CACHES, this mode deterministically assigns caches to allocations based on their types, and not allocation sites.

11 Apr

CrackArmor: Multiple vulnerabilities in AppArmor Article about a variety of vulnerabilities found in the AppArmor LSM implementation, including a few kernel memory corruptions. Authors exploited them to achieve LPE on Ubuntu and Debian. cdn2.qualys.com/advisory/202...

17 Mar

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets Excellent article by Quang Le about exploiting CVE-2025-38617 — a race condition that leads to a use-after-free in the packet sockets implementation. blog.calif.io/p/a-race-wit...

github.comAdd kernelCTF CVE-2025-38617_mitigation_cos by quanggle97 · Pull Request #339 · google/security-research

17 Mar

The implemented exploit was used to pwn the kernelCTF mitigation-v4-6.6 instance. The exploit bypasses CONFIG_RANDOM_KMALLOC_CACHES and CONFIG_SLAB_VIRTUAL. github.com/google/secur...

4 Mar

Analysis of Linux kernel bug fixes Jenny Guanni Qu posted a detailed analysis: — Kernel bugs hide for 2 years on average. Some hide for 20. pebblebed.com/blog/kernel-... — Who Writes the Bugs? A Deeper Look at 125,000 Kernel Vulnerabilities pebblebed.com/blog/kernel-...

youtube.comHardwear.io NL 2025: Glitching Google's TV Streamer From Adb To Root - Niek TimmersYouTube video by hardwear.io

7 Feb

setresuid(⚡): Glitching Google's TV Streamer from adb to root. Talk by Niek Timmers about glitching the kernel of the Android-based Google TV Streamer device to escalate privileges via Electromagnetic Fault Injection. Video: www.youtube.com/watch?v=-w5m... Slides: hardwear.io/netherlands-...

7 Feb

The researcher glitched the setresuid syscall handler to bypass its checks and obtain the UID of 0. Bypassing SELinux via glitching remains to be investigated.