Latest posts
Linux Kernel Security
21 Sept, 15:45edited
CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux KernelPaper by Dong-ok Kim, Juhyun Song, et al. documenting the steps for executing cross-cache attacks for caches with min_partial >= cpu_partial_slabs.The paper also describes a fuzzing-based approach of finding target slab objects useful for exploitation.
Linux Kernel Security
16 Sept, 20:51
Testing race conditions with memory access tracing and stack-based delay injectionArticle by Jann Horn about MAccConc — a KCOV-based tool for exploring possible kernel code interleavings of a multi-threaded program.
Linux Kernel Security
8 Sept, 20:15
SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-FreeArticle about exploiting CVE-2026-64564 in the implementation of the Stream Control Transmission Protocol (SCTP). Authors exploited a UAF in the kmalloc-1k cache to gain root and escape a container.
Linux Kernel Security
14 Aug, 23:01
Gone in 60 Frames – USB Video ExploitationArticle (and slides) by Alex Plaskett and Robert Herrera about fuzzing USB drivers with syzkaller and writing an exploit that gains code execution over USB on Ubuntu.
Linux Kernel Security
11 Aug, 10:12
IonStack part III: Rooting Android 17 with GhostLockArticle about adapting the exploit of CVE-2026-43499 (racy stack use-after-free in the futex implementation) to Android.The researchers used KernelSnitch, ashmem fops overwriting, pipe_buffer corruption, and other tricks to perform LPE.
Linux Kernel Security
23 Jul, 21:59
I handed the epoll UAF to an agentArticle by Guy Beck about using Claude for porting an exploit for an eventpoll vulnerability to Android.
Linux Kernel Security
21 Jul, 23:12
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 yearsArticle about exploiting a racy stack use-after-free in the futex implementation. The bug was used to pwn a kernelCTF instance.
Linux Kernel Security
20 Jul, 22:44
Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694)Article by Stan Shaw about exploiting a page OOB write bug in the FUSE subsystem by overwriting /etc/passwd in the page cache.
Linux Kernel Security
18 Jul, 06:15
Januscape: Guest-to-Host Escape in KVM/x86Hyunwoo Kim published an article about a use-after-free vulnerability in the shadow MMU emulation of KVM/x86 (CVE-2026-53359). Both Intel (VMX) and AMD (SVM) code is affected.The article only covers achieving a kernel crash via this bug, but the vulnerability can also be exploited to escape the guest VM. The author used this bug to pwn a kvmCTF instance.
Linux Kernel Security
8 Jul, 12:39
ITScape: Guest-to-Host Escape in KVM/arm64Article by Hyunwoo Kim about exploiting a race condition bug in the KVM driver on the arm64 architecture to escape the guest VM.
Linux Kernel Security
3 Jul, 14:50
Bad Epoll: The bug missed by MythosArticle by Jaeyoung Chung about exploiting CVE-2026-46242 — a race condition bug in the eventpoll subsystem. Jaeyoung exploited this bug to claim a kernelCTF entry, but the vulnerability also affects Android kernels.
Linux Kernel Security
27 Jun, 14:55
Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215)Stan Shaw published an article about exploiting UAF in a DRM GEM ioctl. The researcher reallocated freed memory as a pipe_buffer array to set PIPE_BUF_FLAG_CAN_MERGE and perform the Dirty Pipe attack.
Linux Kernel Security
25 Jun, 12:48
Off By !: Exploiting a Use-after-Free in the Linux KernelOliver Sieber published a write-up about CVE-2026-23111 in nftables, which they found in early 2025 and other researchers patched upstream in February 2026. The article describes exploiting this UAF on Debian and Ubuntu.Exodus IntelligenceOff By !: Exploiting a Use-after-Free in the Linux Kernel - Exodus IntelligenceBy Oliver Sieber Overview In this blog post, we discuss a use-after-free vulnerability that we found in the nftables subsystem of the Linux kernel in early 2025. This vulnerability was patched upstream on 5 February 2026 and assigned CVE-2026-23111. This…Linux Kernel Security
22 Jun, 11:37
CIFSwitch: a non-universal Linux local root vulnerabilityAsim Viladi Oglu Manizada posted an article about a nice logic bug in the interaction between the kernel CIFS subsystem and the userspace cifs-utils package.An attacker can forge a "cifs.spnego" key in Linux keyring to make the kernel run a root userspace helper to escalate privileges of the attacker's process.Hey, it's AsimCIFSwitch: a non-universal Linux local root vulnerabilityHarnessing LLMs into composing complex, multihop vulnerability chains to discover CVE-2026-46243Linux Kernel Security
10 Jun, 18:43
Unix GC RemasteredArticle by Moe Acherir about the internals of the new Unix sockets garbage collector implementation and the analysis of CVE-2025-40214, which was used in a kernelCTF entry.
Linux Kernel Security
9 Jun, 17:55
PinTheft Linux LPEAaron Esau published an LPE exploit for a page double-free bug in the RDS zerocopy implementation, which can be turned into a page-cache overwrite through io_uring.GitHubpocs/pintheft at main · v12-security/pocspoc it like it's hot. Contribute to v12-security/pocs development by creating an account on GitHub.Linux Kernel Security
3 Jun, 13:55
Logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333)Article about a logical bug in the ptrace implementation that allows getting access to file descriptors of other processes and thus escalating privileges in certain scenarios.
Linux Kernel Security
1 Jun, 14:47
StepStone: LLM-Based GPU Kernel Driver Fuzzing via User-Space LibrariesPaper by Xiaochen Zou et. al about using LLMs for generating syzkaller descriptions for fuzzing GPU drivers via their userspace libraries APIs.
Linux Kernel Security
29 May, 19:16
Privilege Escalation via a Page Use-After-Free in Qualcomm's AI Accelerator Linux Kernel DriverArticle by Lukas Maar about exploiting a bug in the mmap handler of the QAIC driver that causes a page UAF.
Linux Kernel Security
22 May, 11:35
Discovery & Validation in the Linux KernelThree-part article by Samuel Page about analyzing two vulnerabilities (in CAN sockets and FUSE) and attempting to use local LLMs to rediscover the bugs.
Related Channels
Other channels in the same section of the catalogue.
