Gonna be teaching Fuzzing the Linux Kernel training online via Ringzer0 on March 20–25. Covers using/extending syzkaller and KASAN and related areas. I don't deliver this training often, so don't miss the opportunity. ringzer0.training/countermeasu...

The end of a good time slab: remove struct kmem_cache_cpu git.kernel.org/pub/scm/linu... slab: remove cpu (partial) slabs usage from allocation paths git.kernel.org/pub/scm/linu...

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

Today, Project Zero released a 0-click exploit chain for the Pixel 9. While it targets the Pixel, the 0-click bug and exploit techniques we used apply to most other Android devices. projectzero.google/2026/01/pixe...

🚨 REcon 2026 is LIVE! 🚀 Call for papers and registration are now open! Join the world's top reverse engineers & exploit devs in Montreal: 🛠 Trainings: June 15-18 📅 Conference: June 19-21 Tickets & early bird now open → recon.cx Limited spots – see you in MTL! #REcon2026 #ReverseEngineering

@andreyknvl.bsky.social I don't know if this ever got brought up, but for a much more convenient way of doing this, Steam Deck supports this out of the box. You flip the toggle in BIOS, which is exposed by default, and then you can use the gadget directly within the OS. xairy.io/articles/thi...

Gonna be teaching Exploiting the Linux Kernel training at @offensivecon.bsky.social in Berlin on May 11–14th. Half of the spots already taken, so don't miss out. Also note that you can get a conference ticket as a bundle with a training.

🚨 In 2026, Andrey Konovalov - @andreyknvl.bsky.social - returns to OffensiveCon with a training on "Exploiting the Linux Kernel". Find more details here🔗https://buff.ly/dKDboYt 🚀 Don't miss this chance to improve your skills—sign up now!

The trainings' content is unique and exclusive to #offensivecon26, so don’t miss out! NEW: Get your training + conference ticket bundle and secure a conference ticket before the conference ticket shop opens! Tickets: buff.ly/z8YNgoY Don't worry, the conference ticket shop will open…at some point

This is still not fixed btw.

kernelCTF: CVE-2025-38477 kernelCTF entry for a race condition in the network scheduler subsystem. Most notably, shows a technique of putting controlled data into unmapped sections of vmlinux. github.com/n132/securit...

Defeating KASLR by Doing Nothing at All Article by Seth Jenkins about a few problems with physical memory KASLR on arm64 devices. googleprojectzero.blogspot.com/2025/11/defe...

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers Article by Robin Bastide about exploiting a NULL-pointer-dereference that led to a UAF access to the kernel stack in the NVIDIA GPU driver. blog.quarkslab.com/nvidia_gpu_k...

Sheaves support has been merged into SLUB. Opt-in for now, but planned to replace the per-CPU partial slab layer for all caches in the future. Gonna have to revise the slab shaping strategies once this happens.

Delivered a workshop at BalcCon this weekend on emulating/sniffing/MitM'ing USB devices with Raw Gadget and a Raspberry Pi. All materials are public, so can go through the workshop on your own if you're interested. github.com/xairy/raw-ga...

Updated syzkaller documentation on USB fuzzing to explain how to handle certain tricky cases (e.g. driver quirks applied based on Vendor/Product IDs). github.com/google/syzka...

Wrote a trigger for CVE-2025-38494/5 (an integer underflow in the HID subsystem) that leaks 64 KB of OOB memory over USB. Still works on Pixels and Ubuntus (but the bug is fixed in stable kernels). github.com/xairy/kernel...

Updated the collection of USB hacking links. github.com/xairy/usb-ha...

Whoever is coming to BalCCon: I will be teaching a workshop Attacking USB with Raw Gadget (covering basics of USB emulation and sniffing). If you wish to attend, you must bring Raspberry Pi 5 along with a few other things, see the workshop description. github.com/xairy/raw-ga...

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

Linux Kernel netfilter: ipset: Missing Range Check LPE ssd-disclosure.com/linux-kernel...

Announcing #Pwn2Own Ireland for 2025! We return to the Emerald Isle with our new partner #Meta & a $1,000,000 WhatsApp bounty. Plus new USB vectors on phones & more. Read the details https://www.zerodayinitiative.com/blog/2025/7/30/pwn2own-returns-to-ireland-with-a-one-million-dollar-whatsapp-target

Documented instructions for setting up KGDB on Pixel 8. Including getting kernel log over UART via USB-Cereal, building/flashing custom kernel, breaking into KGDB via /proc/sysrq-trigger or by sending SysRq-G over serial, dealing with watchdogs, etc. xairy.io/articles/pix...

Linux Kernel Hardening: Ten Years Deep Talk by Kees Cook about the relevance of various Linux kernel vulnerability classes and the mitigations that address them. Video: www.youtube.com/watch?v=c_Nx... Slides: static.sched.com/hosted_files...

Bypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL Xuan Xing & Eugene Rodionov gave a talk about fuzzing the Linux kernel interfaces fully in user space using LKL (Linux Kernel Library). Video: www.youtube.com/watch?v=Wxmi... Slides: static.sched.com/hosted_files...

Schedule for my Fuzzing/Exploiting the Linux Kernel trainings for the rest of the year ⬇️

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

RVAsec 2025: Kevin Massey - Linux Kernel Exploitation for Beginners youtu.be/YfjHCt4SzQc Linux Kernel Exploitation For Beginners rvasec.com/slides/2025/...

KernelGP: Racing Against the Android Kernel Talk by Chariton Karamitas about ways to use FUSE for kernel exploitation from unprivileged SELinux contexts on Android. www.youtube.com/watch?v=DJBG...

Linux Kernel Exploitation series Awesome series of articles by r1ru that outlines many commonly-used modern exploitation techniques. r1ru.github.io/categories/l...

with offensivecon around the corner, i figured id write another post on linux kernel exploitation techniques - this time i cover the world of page table exploitation! enjoy 🤓 sam4k.com/page-table-k...

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

Gave a talk on external fuzzing of Linux kernel USB drivers with syzkaller at SAFACon. Includes a demonstration of how to rediscover CVE-2024-53104, an out-of-bounds bug in the USB Video Class driver. Slides: docs.google.com/presentation...

Unlocking secret ThinkPad functionality for emulating USB devices : xairy.io/articles/thi... credits @andreyknvl.bsky.social

Exploiting the Linux Kernel by Andrey Konovalov (@andreyknvl.bsky.social) www.hexacon.fr/trainer/kono...

Kernel-Hack-Drill: Environment For Developing Linux Kernel Exploits Alexander Popov published the slides from his talk at Zer0Con 2025. a13xp0p0v.github.io/img/Alexande...

My new blog post, which I presented at #Zer0Con2025 A binary level macOS KEXT kernel address sanitizer r00tkitsmm.github.io/fuzzing/2025...

Three bypasses of Ubuntu's unprivileged user namespace restrictions seclists.org/oss-sec/2025...

When Good Kernel Defences Go Bad: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks Awesome paper by Lukas Maar et al. about leaking exploitation-relevant kernel addresses via a TLB side-channel attack. lukasmaar.github.io/papers/useni...

Happy to share my slides from BOOTSTRAP25. Unfortunately the bug discussed is still not patched in Linux 6.14.0 despite it being reported explicitly. Slides are in markdown but there's a PDF in "releases" too github.com/jduck/bs25-s...

New attack surface for Pwn2Own unlocked? 😁 Unprivileged mounting allows reaching a staggering number of bugs in the filesystem drivers; see the syzbot dashboard (click through "Child subsystems"): syzkaller.appspot.com/upstream/s/fs

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

Looks like we have a confirmation that Cellebrite uses memory corruptions in Linux kernel USB drivers to unlock Android phones. First 2 bugs seem easily discoverable by syzkaller/syzbot with a bit of extra descriptions. 3rd one is likely as well ⤵️

Pumpkin (@u1f383 on X) does cool work. Here is another cool read about an interesting race condition involving signal handling u1f383.github.io/linux/2025/0...

Patch-Gapping the Google Container-Optimized OS for $0 Detailed article by h0mbre about exploiting a slab use-after-free in the network scheduler subsystem to target the COS 105 kernelCTF instance. h0mbre.github.io/Patch_Gappin...

I gave a day 1 closing keynote at DistrictCon yesterday. Surprisingly, it was a security talk about memory safety. Slides are here: docs.google.com/presentation...

Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793) Article by Ng Zhi Yang about exploiting a logical bug in the Arm Mali GPU driver discovered a few years ago. starlabs.sg/blog/2025/12...

Schedule for my Linux kernel security trainings this year is shaping up 🥳 New standalone training: Fuzzing the Linux Kernel. Focused on fuzzing with syzkaller but also covers using/extending KASAN. The usual Exploiting the Linux Kernel training is on the menu as well. ⬇️

I've made an interactive list of #eBPF research papers. Only papers from the top academic conferences, including lots of papers on eBPF verification, kernel offloads, security analysis, etc. pchaigno.github.io/bpf/2025/01/... I plan to keep the list up-to-date.