Gonna be teaching Exploiting the Linux Kernel training at RomHack in Rome on September 28 — October 1st. Last planned session of this training for the year. Early Bird discount until the end of the week. romhack.io/training/202...

Recent Page Cache Corruption Bugs All stem from code paths that allow in-place overwrites of user-supplied input pages without verifying they are writable. This enables overwriting page cache and thus changing in-memory contents of read-only files. Selected links below ⬇️

From KernelSnitch to Practical msg_msg/pipe_buffer Heap KASLR Leaks Article by Lukas Maar about evaluating the KernelSnitch timing side-channel attack on a variety of systems, including Android. lukasmaar.github.io/posts/heap-k...

2 years ago I did a PoC to run #rust 🦀 in the #pixel modem Today it shipped in millions of devices! They grow up to fast! 🥲 security.googleblog.com/2026/04/brin... #rust #security #smartphone #baseband

Software-only timing side-channel leaking mm_struct without a memory-safety bug, pivoting via cross-cache reuse to msg_msg/pipe_buffer, effective even on MTE. lukasmaar.github.io/posts/heap-k... Credits: Lukas Maar #infosec

New BSides Canberra 2025 talk by Angus is now live: “Walkthrough of an N-day Android GPU driver vulnerability.” Watch here: youtu.be/G71dB0C4-dY

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets Excellent article by Quang Le about exploiting CVE-2025-38617 — a race condition that leads to a use-after-free in the packet sockets implementation. blog.calif.io/p/a-race-wit...

Extended the Pixel 8 KGDB article with the instructions on how to set up GEF. slub-dump, buddy-dump, and some other commands now work. Huge thanks to bata24 for implementing all required pieces. xairy.io/articles/pix...

Gonna be teaching Exploiting the Android Kernel training at Zer0Con 2026 on March 30th — April 1st. This is a new training focused on data-only Android kernel exploitation techniques. Just a bit of time left to sign up. Pay attention to the requirements. zer0con.org#training-sec...

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

Gonna be teaching Fuzzing the Linux Kernel training online via Ringzer0 on March 20–25. Covers using/extending syzkaller and KASAN and related areas. I don't deliver this training often, so don't miss the opportunity. ringzer0.training/countermeasu...

The end of a good time slab: remove struct kmem_cache_cpu git.kernel.org/pub/scm/linu... slab: remove cpu (partial) slabs usage from allocation paths git.kernel.org/pub/scm/linu...

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

Today, Project Zero released a 0-click exploit chain for the Pixel 9. While it targets the Pixel, the 0-click bug and exploit techniques we used apply to most other Android devices. projectzero.google/2026/01/pixe...

🚨 REcon 2026 is LIVE! 🚀 Call for papers and registration are now open! Join the world's top reverse engineers & exploit devs in Montreal: 🛠 Trainings: June 15-18 📅 Conference: June 19-21 Tickets & early bird now open → recon.cx Limited spots – see you in MTL! #REcon2026 #ReverseEngineering

@andreyknvl.bsky.social I don't know if this ever got brought up, but for a much more convenient way of doing this, Steam Deck supports this out of the box. You flip the toggle in BIOS, which is exposed by default, and then you can use the gadget directly within the OS. xairy.io/articles/thi...

Gonna be teaching Exploiting the Linux Kernel training at @offensivecon.bsky.social in Berlin on May 11–14th. Half of the spots already taken, so don't miss out. Also note that you can get a conference ticket as a bundle with a training.

🚨 In 2026, Andrey Konovalov - @andreyknvl.bsky.social - returns to OffensiveCon with a training on "Exploiting the Linux Kernel". Find more details here🔗https://buff.ly/dKDboYt 🚀 Don't miss this chance to improve your skills—sign up now!

The trainings' content is unique and exclusive to #offensivecon26, so don’t miss out! NEW: Get your training + conference ticket bundle and secure a conference ticket before the conference ticket shop opens! Tickets: buff.ly/z8YNgoY Don't worry, the conference ticket shop will open…at some point

This is still not fixed btw.

kernelCTF: CVE-2025-38477 kernelCTF entry for a race condition in the network scheduler subsystem. Most notably, shows a technique of putting controlled data into unmapped sections of vmlinux. github.com/n132/securit...

Defeating KASLR by Doing Nothing at All Article by Seth Jenkins about a few problems with physical memory KASLR on arm64 devices. googleprojectzero.blogspot.com/2025/11/defe...

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers Article by Robin Bastide about exploiting a NULL-pointer-dereference that led to a UAF access to the kernel stack in the NVIDIA GPU driver. blog.quarkslab.com/nvidia_gpu_k...

Sheaves support has been merged into SLUB. Opt-in for now, but planned to replace the per-CPU partial slab layer for all caches in the future. Gonna have to revise the slab shaping strategies once this happens.

Delivered a workshop at BalcCon this weekend on emulating/sniffing/MitM'ing USB devices with Raw Gadget and a Raspberry Pi. All materials are public, so can go through the workshop on your own if you're interested. github.com/xairy/raw-ga...

Updated syzkaller documentation on USB fuzzing to explain how to handle certain tricky cases (e.g. driver quirks applied based on Vendor/Product IDs). github.com/google/syzka...

Wrote a trigger for CVE-2025-38494/5 (an integer underflow in the HID subsystem) that leaks 64 KB of OOB memory over USB. Still works on Pixels and Ubuntus (but the bug is fixed in stable kernels). github.com/xairy/kernel...

Updated the collection of USB hacking links. github.com/xairy/usb-ha...

Whoever is coming to BalCCon: I will be teaching a workshop Attacking USB with Raw Gadget (covering basics of USB emulation and sniffing). If you wish to attend, you must bring Raspberry Pi 5 along with a few other things, see the workshop description. github.com/xairy/raw-ga...

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

Linux Kernel netfilter: ipset: Missing Range Check LPE ssd-disclosure.com/linux-kernel...

Announcing #Pwn2Own Ireland for 2025! We return to the Emerald Isle with our new partner #Meta & a $1,000,000 WhatsApp bounty. Plus new USB vectors on phones & more. Read the details https://www.zerodayinitiative.com/blog/2025/7/30/pwn2own-returns-to-ireland-with-a-one-million-dollar-whatsapp-target

Documented instructions for setting up KGDB on Pixel 8. Including getting kernel log over UART via USB-Cereal, building/flashing custom kernel, breaking into KGDB via /proc/sysrq-trigger or by sending SysRq-G over serial, dealing with watchdogs, etc. xairy.io/articles/pix...

Linux Kernel Hardening: Ten Years Deep Talk by Kees Cook about the relevance of various Linux kernel vulnerability classes and the mitigations that address them. Video: www.youtube.com/watch?v=c_Nx... Slides: static.sched.com/hosted_files...

Bypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL Xuan Xing & Eugene Rodionov gave a talk about fuzzing the Linux kernel interfaces fully in user space using LKL (Linux Kernel Library). Video: www.youtube.com/watch?v=Wxmi... Slides: static.sched.com/hosted_files...

Schedule for my Fuzzing/Exploiting the Linux Kernel trainings for the rest of the year ⬇️

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

RVAsec 2025: Kevin Massey - Linux Kernel Exploitation for Beginners youtu.be/YfjHCt4SzQc Linux Kernel Exploitation For Beginners rvasec.com/slides/2025/...

KernelGP: Racing Against the Android Kernel Talk by Chariton Karamitas about ways to use FUSE for kernel exploitation from unprivileged SELinux contexts on Android. www.youtube.com/watch?v=DJBG...

Linux Kernel Exploitation series Awesome series of articles by r1ru that outlines many commonly-used modern exploitation techniques. r1ru.github.io/categories/l...

with offensivecon around the corner, i figured id write another post on linux kernel exploitation techniques - this time i cover the world of page table exploitation! enjoy 🤓 sam4k.com/page-table-k...

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

Gave a talk on external fuzzing of Linux kernel USB drivers with syzkaller at SAFACon. Includes a demonstration of how to rediscover CVE-2024-53104, an out-of-bounds bug in the USB Video Class driver. Slides: docs.google.com/presentation...

Unlocking secret ThinkPad functionality for emulating USB devices : xairy.io/articles/thi... credits @andreyknvl.bsky.social

Exploiting the Linux Kernel by Andrey Konovalov (@andreyknvl.bsky.social) www.hexacon.fr/trainer/kono...

Kernel-Hack-Drill: Environment For Developing Linux Kernel Exploits Alexander Popov published the slides from his talk at Zer0Con 2025. a13xp0p0v.github.io/img/Alexande...

My new blog post, which I presented at #Zer0Con2025 A binary level macOS KEXT kernel address sanitizer r00tkitsmm.github.io/fuzzing/2025...

Three bypasses of Ubuntu's unprivileged user namespace restrictions seclists.org/oss-sec/2025...

When Good Kernel Defences Go Bad: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks Awesome paper by Lukas Maar et al. about leaking exploitation-relevant kernel addresses via a TLB side-channel attack. lukasmaar.github.io/papers/useni...