A Syzkaller Summer: Fixing False Positive Soft Lockups in net/sched Fuzzing Article by Will's Root about fixing the soft lockup bug found when fuzzing the network scheduler subsystem with syzkaller. www.willsroot.io/2025/09/syz-...

corCTF 2025 - corphone Article by Pumpkin about exploiting a UAF in a custom Android kernel module created for a CTF task. u1f383.github.io/android/2025...

Exploit for an integer underflow bug in the HID subsystem that allows leaking up to 64 KB of kernel memory over USB.

ksmbd - Fuzzing Improvements and Vulnerability Discovery Another article by Norbert Szetei about fuzzing the ksmbd module with syzkaller. blog.doyensec.com/2025/09/02/k...

arm64: Linear mapping is mapped at the same static virtual address Bug report by Seth Jenkins and Jann Horn showing that the physmap region is mapped at a fixed virtual address on Android despite KASLR. project-zero.issues.chromium.org/issues/43420...

Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel Alexander Popov published an article about exploiting a race condition in AF_VSOCK subsystem, the bug that received a Pwnie Award 2025. a13xp0p0v.github.io/2025/09/02/k...

Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel Alexander Popov published an article about exploiting a race condition in AF_VSOCK subsystem, the bug that received a Pwnie Award 2025. a13xp0p0v.github.io/2025/09/02/k...

From Chrome renderer code exec to kernel with MSG_OOB Jann Horn posted an article about exploiting CVE-2025-38236, a UAF in the UNIX domain sockets. googleprojectzero.blogspot.com/2025/08/from...

Exploiting All Google kernelCTF Instances And Debian 12 With A 0-Day For $82k Article by Crusaders of Rust about exploiting a UAF in the network packet scheduler. Researchers manipulated red-black trees to achieve a page-level UAF and escalate privileges. syst3mfailure.io/rbtree-famil...

Setting up kernel exploit debugging environment on Pixel 8 ⬇️

CVE-2023-52927 - Turning a Forgotten Syzkaller Report into kCTF Exploit Article by Hoàng Hải Long about finding an unfixed netfilter use-after-free bug reported by syzbot. The researcher exploited it to pwn the kernelCTF COS instance. seadragnol.github.io/posts/CVE-20...

Fuzzing Linux Kernel Modules, with Slava Moskvin Stream by @sl4v.bsky.social hosted by @steph3nsims.bsky.social about building a custom fuzzer to rediscover CVE-2025-0927 in the HFS+ filesystem implementation. www.youtube.com/live/uCcsZrX...

Linux Kernel Hardening: Ten Years Deep Talk by Kees Cook about the relevance of various Linux kernel vulnerability classes and the mitigations that address them. Video: www.youtube.com/watch?v=c_Nx... Slides: static.sched.com/hosted_files...

Bypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL Xuan Xing & Eugene Rodionov gave a talk about fuzzing the Linux kernel interfaces fully in user space using LKL (Linux Kernel Library). Video: www.youtube.com/watch?v=Wxmi... Slides: static.sched.com/hosted_files...

The Journey of Bypassing Ubuntu’s Unprivileged Namespace Restriction Article by Pumpkin about the internals of the Ubuntu's implementation of restricting unprivileged user namespaces and figuring out another bypass method. u1f383.github.io/linux/2025/0...

Exploiting the CVE-2025-21756 1-day vulnerability Hyunwoo Kim and Wongi Lee posted a kernelCTF report about exploiting a UAF in the vsock subsystem of the Linux kernel. github.com/google/secur...

Solo: A Pixel 6 Pro Story (When one bug is all you need) Awesome article by Lin Ze Wei about adapting the Pixel 7/8 exploit for a bug in the Mali GPU driver to Pixel 6 Pro. starlabs.sg/blog/2025/06...

Bypassing MTE with CVE-2025-0072 Article by Man Yue Mo about exploiting a page use-after-free vulnerability in the ARM's Mali GPU driver in the code that manages userspace-mapped pages. github.blog/security/vul...

How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel's SMB implementation Article by Sean Heelan about rediscovering a bug in the ksmbd module via the OpenAI's o3 model and then finding a 0-day vulnerability as well. sean.heelan.io/2025/05/22/h...

Android In-The-Wild: Unexpectedly Excavating a Kernel Exploit Talk by Seth Jenkins about analyzing the traces of an In-The-Wild exploit that targeted the Qualcomm adsprpc driver. www.youtube.com/watch?v=lnK1...

KernelGP: Racing Against the Android Kernel Talk by Chariton Karamitas about ways to use FUSE for kernel exploitation from unprivileged SELinux contexts on Android. www.youtube.com/watch?v=DJBG...

Kernel Exploitation Techniques: Turning The (Page) Tables Article by @sam4k.com giving a great introduction to the page table attacks. sam4k.com/page-table-k...

[CVE-2025-37752] Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds Great article by D3vil about exploiting a type confusion in the network scheduler subsystem and pwning all kernelCTF instances. syst3mfailure.io/two-bytes-of...

A Quick Dive Into The Linux Kernel Page Allocator Article by D3vil that explains the internals of the Page allocator. syst3mfailure.io/linux-page-a...

Linux Kernel Exploitation series Awesome series of articles by r1ru that outlines many commonly-used modern exploitation techniques. r1ru.github.io/categories/l...

RISC-V support in kernel-hardening-checker Alexander Popov added RISC-V support to kernel-hardening-checker. Now, you can check the Linux kernel security parameters for RISC-V in addition to X86_64, ARM64, X86_32, and ARM. github.com/a13xp0p0v/ke...

CVE-2025-21756: Attack of the Vsock Michael Hoefler published an article about exploiting an incorrect reference counter decrement causing a UAF in the vsock subsystem. hoefler.dev/articles/vso...

Guidance on how to use syzkaller to find bugs in USB drivers that can be exploited by a malicious USB device 👇

Exploiting CVE-2024-0582 via the Dirty Pagetable Method Kuzey Arda Bulut posted an article about exploiting CVE-2024-0582 in io_uring using the Dirty Pagetable technique. kuzey.rs/posts/Dirty_...

Kernel-Hack-Drill: Environment For Developing Linux Kernel Exploits Alexander Popov published the slides from his talk at Zer0Con 2025. a13xp0p0v.github.io/img/Alexande...

Three bypasses of Ubuntu's unprivileged user namespace restrictions Article about bypassing the recent Ubuntu's restriction on getting capabilities in unprivileged user namespaces. www.qualys.com/2025/three-b...

When Good Kernel Defences Go Bad: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks Awesome paper by Lukas Maar et al. about leaking exploitation-relevant kernel addresses via a TLB side-channel attack. lukasmaar.github.io/papers/useni...

Linux kernel Rust module for rootkit detection Article by Antoine Doglioli about implementing an in-kernel detector for many existing rootkits. The detector is written in Rust. blog.thalium.re/posts/linux-...

Linux kernel hfsplus slab-out-of-bounds Write Outstanding article by Attila Szasz about exploiting a slab out-of-bounds bug in the HFS+ filesystem driver. ssd-disclosure.com/ssd-advisory...

Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch V4bel posted another method of triggering modprobe for executing the modprobe_path privilege escalation technique. blog.theori.io/reviving-the...

Is this memory safety here in the room with us? @halvarflake.bsky.social posted slides for his keynote talk about the recent trends to resolve the problem of memory corruptions: existing solutions, their limitations, and trade-offs. docs.google.com/presentation...

Patch-Gapping the Google Container-Optimized OS for $0 Detailed article by h0mbre about exploiting a slab use-after-free in the network scheduler subsystem to target the COS 105 kernelCTF instance. h0mbre.github.io/Patch_Gappin...

Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793) Article by Ng Zhi Yang about exploiting a logical bug in the Arm Mali GPU driver discovered a few years ago. starlabs.sg/blog/2025/12...

Accidentally uncovering a seven years old vulnerability in the Linux kernel Article by @andersonc0d3.bsky.social about finding and analyzing a slab use-after-free vulnerability in the TCP sockets implementation. allelesecurity.com/accidentally...

ksmbd vulnerability research Article by Norbert Szetei about fuzzing the ksmbd module with syzkaller and finding a few memory corruption vulnerabilities. blog.doyensec.com/2025/01/07/k...

KernelSnitch: Side-Channel Attacks on Kernel Data Structures Paper by Lukas Maar et al. about using a timing side-channel for leaking addresses of exploitation-relevant kernel structures. lukasmaar.github.io/papers/ndss2...

Finding Bugs in Kernel series A series of introductory articles by Slava Moskvin about using KASAN and syzkaller for finding kernel vulnerabilities. 1: slavamoskvin.com/hunting-bugs... 2: slavamoskvin.com/finding-bugs... 3: slavamoskvin.com/finding-bugs...

The Qualcomm DSP Driver — Unexpectedly Excavating an Exploit Article by Seth Jenkins about investigating kernel crash logs produced by an In-The-Wild exploit that targeted the adsprpc Qualcomm driver and finding several vulnerabities in that driver. googleprojectzero.blogspot.com/2024/12/qual...

Bootkitty: Analyzing the first UEFI bootkit for Linux Martin Smolár and Peter Strýček published a report about a PoC UEFI bootkit targeting Linux systems. As a part of it, the bootkit patches the Linux kernel image to disable the module signature checking. www.welivesecurity.com/en/eset-rese...

Diving into Linux kernel security Alexander Popov published his H2HC talk slides that describe how to get started with learning Linux kernel security and knowingly configure the security parameters of Linux-based systems. a13xp0p0v.github.io/img/Alexande...

OtterRoot: Netfilter Universal Root 1-day An article by @0xten.bsky.social about exploiting a slab double-free bug in the netfilter subsystem. osec.io/blog/2024-11...

Novel approach to exploit a limited OOB on Ubuntu at Pwn2Own Vancouver 2024 Slides from a talk by Pumpkin Chang about exploiting a stack out-of-bounds write bug in the traffic control subsystem. u1f383.github.io/slides/talks...

Defects-in-Depth: Analyzing the Integration of Effective Defenses against One-Day Exploits in Android Kernels www.usenix.org/system/files...

1day vuln dev: DirtyCOW A video by SideQuest covering the author's approach to analyzing the DirtyCow vulnerability. www.youtube.com/watch?v=lQOi...

Restricting Unprivileged User Namespaces In Ubuntu A talk by John Johansen and Maxime Bélair about restricting capabilities within user namespaces in Ubuntu 24.04. Slides: static.sched.com/hosted_files... Video: www.youtube.com/watch?v=GcVj...