Linux Kernel Security

Links related to Linux kernel security and exploitation.
Maintained by @andreyknvl and @a13xp0p0v.

[Linux Kernel Security @linkersec]

Bad UVM

Article by Ziyi Guo about escaping an NVidia Container Toolkit container by exploiting a logical bug in the NVidia GPU driver.

https://t.co/5ijlXPA2un

[Linux Kernel Security @linkersec]

When Defenses Become Attack Surface: CVE-2026-20971, a Samsung Kernel UAF

Article about analyzing exploitation primitives derived from a racy use-after-free bug in the Samsung PROCA (Process Authenticator) kernel module.

https://t.co/3SzgSG3G4k

[Linux Kernel Security @linkersec]

SoK: Take a Deep Step into Linux Kernel Hardening Effectiveness from the Offensive-Defensive Perspective

A paper with analysis of 121 publicly documented exploits since 2015 and in-depth evaluation of 51 existing kernel defense mechanisms.

https://t.co/i2Izk3y8Xm

[Linux Kernel Security @linkersec]

PageJack in Action: CVE-2022-0995 exploit

Article by Jean Vincent describing how a relatively old CVE can be exploited using the PageJack exploitation technique.

https://t.co/TYytvd193p

[Linux Kernel Security @linkersec]

The paper also describes a fuzzing-based approach of finding target slab objects useful for exploitation.

[Linux Kernel Security @linkersec]

CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel

Paper by Dong-ok Kim, Juhyun Song, et al. documenting the steps for executing a cross-cache attacks for caches with min_partial >= cpu_partial_slabs.

https://t.co/IsZAzZh83g

[Linux Kernel Security @linkersec]

Testing race conditions with memory access tracing and stack-based delay injection

Article by @tehjh about MAccConc — a KCOV-based tool for exploring possible kernel code interleavings of a multi-threaded program.

Article: https://t.co/7hno0DJrec
Tool: https://t.co/ADoZWhlhcC

[Linux Kernel Security @linkersec]

SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free

Article about exploiting CVE-2026-64564 in the Stream Control Transmission Protocol (SCTP) implementation. Authors exploited a UAF in the kmalloc-1k cache to gain root and escape a container
https://t.co/kNuy8eNdvS

[Linux Kernel Security @linkersec]

Gone in 60 Frames – USB Video Exploitation

Article (and slides) by @alexjplaskett and @robHerrera_ about fuzzing USB drivers with syzkaller and writing an exploit that gains code execution over USB on Ubuntu.

Article: https://t.co/lhXlMz7NPX
Slides: https://t.co/DpRmtHf0yH

[Linux Kernel Security @linkersec]

IonStack part III: Rooting Android 17 with GhostLock

Article about adapting the exploit of CVE-2026-43499 (kernel stack UAF) to Android.

The researchers used KernelSnitch, ashmem fops overwriting, pipe_buffer corruption, and other tricks to perform LPE.

https://t.co/QuGMreetzH

[Linux Kernel Security @linkersec]

I handed the epoll UAF to an agent

Article by Guy Beck about using Claude for porting an exploit for an eventpoll vulnerability to Android.

https://t.co/OrQfrnIq1S

[Linux Kernel Security @linkersec]

IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years

Article about exploiting a racy stack use-after-free in the futex implementation. The bug was used to pwn a kernelCTF instance.

https://t.co/HaAcgBLEXp

[Linux Kernel Security @linkersec]

The article only covers achieving a kernel crash via this bug, but the vulnerability can also be exploited to escape the guest VM. The author used this bug to pwn a kvmCTF instance.

[Linux Kernel Security @linkersec]

Januscape: Guest-to-Host Escape in KVM/x86

@v4bel published an article about a use-after-free vulnerability in the shadow MMU emulation of KVM/x86 (CVE-2026-53359). Both Intel (VMX) and AMD (SVM) code is affected.

https://t.co/xDH9C1UkUq

[Linux Kernel Security @linkersec]

ITScape: Guest-to-Host Escape in KVM/arm64

Article by @v4bel about exploiting a race condition bug in the KVM driver on the arm64 architecture to escape the guest VM.

https://t.co/6ITHojudKa

[Linux Kernel Security @linkersec]

Bad Epoll: The bug missed by Mythos

Article by Jaeyoung Chung about exploiting CVE-2026-46242 — a race condition bug in the eventpoll subsystem. Jaeyoung exploited this bug to claim a kernelCTF entry, but the vulnerability also affects Android kernels.

https://t.co/zvEvS8dOzQ

[Linux Kernel Security @linkersec]

Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215)

Stan Shaw published an article about exploiting UAF in a DRM GEM ioctl. The researcher reallocated freed memory as a pipe_buffer array to perform the Dirty Pipe attack.

https://t.co/bv8TectvdB

[Linux Kernel Security @linkersec]

Off By !: Exploiting a Use-after-Free in the Linux Kernel

Oliver Sieber published write-up on CVE-2026-23111 in nftables, found in early 2025, patched upstream by other researchers in Feb 2026. Article describes exploiting this UAF on Debian and Ubuntu.

https://t.co/z52Nn6qs3U

[Linux Kernel Security @linkersec]

An attacker can forge a "cifs.spnego" key in Linux keyring to make the kernel run a root userspace helper to escalate privileges of the attacker's process.

[Linux Kernel Security @linkersec]

CIFSwitch: a non-universal Linux local root vulnerability

Asim Viladi Oglu Manizada posted an article about a nice logic bug in the interaction between the kernel CIFS subsystem and the userspace cifs-utils package.

https://t.co/c9D3mVMg52