Enhancing FineIBT @lwndotnet.bsky.social article that describes the talk by Scott Constable and Sebastian Österlund about the ongoing work to improve FineIBT (Fine-grain Control-flow Enforcement with Indirect Branch Tracking). lwn.net/Articles/103...

Cracking the Pixel 8: Exploiting the Undocumented DSP to Bypass MTE Talk by Pan Zhenpeng and Jheng Bing Jhong about exploiting a logical bug in the Pixel GXP driver that allows overwriting read-only files. Video: www.youtube.com/watch?v=_iSw... Slides: hitcon.org/2025/slides/...

Exploiting CVE-2025-21479 on a Samsung S23 Article by XploitBengineer about exploiting a logical bug in the Qualcomm Adreno GPU firmware to take over the kernel on Samsung S23 via a combination of page table attacks. xploitbengineer.github.io/CVE-2025-21479

LPE via refcount imbalance in the af_unix of Ubuntu Article and exploit by kylebot for a refcount imbalance bug in the Ubuntu kernel's Unix sockets implementation disclosed during the TyphoonPWN 2025 competition. ssd-disclosure.com/lpe-via-refc...

kernelCTF: CVE-2025-38477 kernelCTF entry for a race condition in the network scheduler subsystem. Most notably, shows a technique of putting controlled data into unmapped sections of vmlinux. github.com/n132/securit...

Defeating KASLR by Doing Nothing at All Article by Seth Jenkins about a few problems with physical memory KASLR on arm64 devices. googleprojectzero.blogspot.com/2025/11/defe...

Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers Article by Robin Bastide about exploiting a NULL-pointer-dereference that led to a UAF access to the kernel stack in the NVIDIA GPU driver. blog.quarkslab.com/nvidia_gpu_k...

ksmbd - Exploiting CVE-2025-37947 Article by Norbert Szetei about locally exploiting CVE-2025-37947 — a page OOB write in the ksmbd module. Article: blog.doyensec.com/2025/10/08/k... Exploit: github.com/doyensec/KSM...

Dirty Pageflags: Revisiting PTE Exploitation in Linux Article by ptr-yudai on the exploitation technique of overwriting the R/W flag in a PTE entry to allow writing into read-only files. ptr-yudai.hatenablog.com/entry/2025/0...

Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days William Liu posted an article about exploiting a slab object overflow (CVE-2023-52440) and remote infoleak (CVE-2023-4130) in the kernel SMB3 daemon to gain RCE. www.willsroot.io/2025/09/ksmb...

The anatomy of a bug: 6 Months at STAR Labs Gerrard Tai posted an article describing their experience in finding kernel bugs and participating in the KernelCTF and Pwn2Own competitions. gerrardtai.com/anatomy-of-a...

A Syzkaller Summer: Fixing False Positive Soft Lockups in net/sched Fuzzing Article by Will's Root about fixing the soft lockup bug found when fuzzing the network scheduler subsystem with syzkaller. www.willsroot.io/2025/09/syz-...

corCTF 2025 - corphone Article by Pumpkin about exploiting a UAF in a custom Android kernel module created for a CTF task. u1f383.github.io/android/2025...

Exploit for an integer underflow bug in the HID subsystem that allows leaking up to 64 KB of kernel memory over USB.

ksmbd - Fuzzing Improvements and Vulnerability Discovery Another article by Norbert Szetei about fuzzing the ksmbd module with syzkaller. blog.doyensec.com/2025/09/02/k...

arm64: Linear mapping is mapped at the same static virtual address Bug report by Seth Jenkins and Jann Horn showing that the physmap region is mapped at a fixed virtual address on Android despite KASLR. project-zero.issues.chromium.org/issues/43420...

Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel Alexander Popov published an article about exploiting a race condition in AF_VSOCK subsystem, the bug that received a Pwnie Award 2025. a13xp0p0v.github.io/2025/09/02/k...

Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel Alexander Popov published an article about exploiting a race condition in AF_VSOCK subsystem, the bug that received a Pwnie Award 2025. a13xp0p0v.github.io/2025/09/02/k...

From Chrome renderer code exec to kernel with MSG_OOB Jann Horn posted an article about exploiting CVE-2025-38236, a UAF in the UNIX domain sockets. googleprojectzero.blogspot.com/2025/08/from...

Exploiting All Google kernelCTF Instances And Debian 12 With A 0-Day For $82k Article by Crusaders of Rust about exploiting a UAF in the network packet scheduler. Researchers manipulated red-black trees to achieve a page-level UAF and escalate privileges. syst3mfailure.io/rbtree-famil...

Setting up kernel exploit debugging environment on Pixel 8 ⬇️

CVE-2023-52927 - Turning a Forgotten Syzkaller Report into kCTF Exploit Article by Hoàng Hải Long about finding an unfixed netfilter use-after-free bug reported by syzbot. The researcher exploited it to pwn the kernelCTF COS instance. seadragnol.github.io/posts/CVE-20...

Fuzzing Linux Kernel Modules, with Slava Moskvin Stream by @sl4v.bsky.social hosted by @steph3nsims.bsky.social about building a custom fuzzer to rediscover CVE-2025-0927 in the HFS+ filesystem implementation. www.youtube.com/live/uCcsZrX...

Linux Kernel Hardening: Ten Years Deep Talk by Kees Cook about the relevance of various Linux kernel vulnerability classes and the mitigations that address them. Video: www.youtube.com/watch?v=c_Nx... Slides: static.sched.com/hosted_files...

Bypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL Xuan Xing & Eugene Rodionov gave a talk about fuzzing the Linux kernel interfaces fully in user space using LKL (Linux Kernel Library). Video: www.youtube.com/watch?v=Wxmi... Slides: static.sched.com/hosted_files...

The Journey of Bypassing Ubuntu’s Unprivileged Namespace Restriction Article by Pumpkin about the internals of the Ubuntu's implementation of restricting unprivileged user namespaces and figuring out another bypass method. u1f383.github.io/linux/2025/0...

Exploiting the CVE-2025-21756 1-day vulnerability Hyunwoo Kim and Wongi Lee posted a kernelCTF report about exploiting a UAF in the vsock subsystem of the Linux kernel. github.com/google/secur...

Solo: A Pixel 6 Pro Story (When one bug is all you need) Awesome article by Lin Ze Wei about adapting the Pixel 7/8 exploit for a bug in the Mali GPU driver to Pixel 6 Pro. starlabs.sg/blog/2025/06...

Bypassing MTE with CVE-2025-0072 Article by Man Yue Mo about exploiting a page use-after-free vulnerability in the ARM's Mali GPU driver in the code that manages userspace-mapped pages. github.blog/security/vul...

How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel's SMB implementation Article by Sean Heelan about rediscovering a bug in the ksmbd module via the OpenAI's o3 model and then finding a 0-day vulnerability as well. sean.heelan.io/2025/05/22/h...

Android In-The-Wild: Unexpectedly Excavating a Kernel Exploit Talk by Seth Jenkins about analyzing the traces of an In-The-Wild exploit that targeted the Qualcomm adsprpc driver. www.youtube.com/watch?v=lnK1...

KernelGP: Racing Against the Android Kernel Talk by Chariton Karamitas about ways to use FUSE for kernel exploitation from unprivileged SELinux contexts on Android. www.youtube.com/watch?v=DJBG...

Kernel Exploitation Techniques: Turning The (Page) Tables Article by @sam4k.com giving a great introduction to the page table attacks. sam4k.com/page-table-k...

[CVE-2025-37752] Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds Great article by D3vil about exploiting a type confusion in the network scheduler subsystem and pwning all kernelCTF instances. syst3mfailure.io/two-bytes-of...

A Quick Dive Into The Linux Kernel Page Allocator Article by D3vil that explains the internals of the Page allocator. syst3mfailure.io/linux-page-a...

Linux Kernel Exploitation series Awesome series of articles by r1ru that outlines many commonly-used modern exploitation techniques. r1ru.github.io/categories/l...

RISC-V support in kernel-hardening-checker Alexander Popov added RISC-V support to kernel-hardening-checker. Now, you can check the Linux kernel security parameters for RISC-V in addition to X86_64, ARM64, X86_32, and ARM. github.com/a13xp0p0v/ke...

CVE-2025-21756: Attack of the Vsock Michael Hoefler published an article about exploiting an incorrect reference counter decrement causing a UAF in the vsock subsystem. hoefler.dev/articles/vso...

Guidance on how to use syzkaller to find bugs in USB drivers that can be exploited by a malicious USB device 👇

Exploiting CVE-2024-0582 via the Dirty Pagetable Method Kuzey Arda Bulut posted an article about exploiting CVE-2024-0582 in io_uring using the Dirty Pagetable technique. kuzey.rs/posts/Dirty_...

Kernel-Hack-Drill: Environment For Developing Linux Kernel Exploits Alexander Popov published the slides from his talk at Zer0Con 2025. a13xp0p0v.github.io/img/Alexande...

Three bypasses of Ubuntu's unprivileged user namespace restrictions Article about bypassing the recent Ubuntu's restriction on getting capabilities in unprivileged user namespaces. www.qualys.com/2025/three-b...

When Good Kernel Defences Go Bad: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks Awesome paper by Lukas Maar et al. about leaking exploitation-relevant kernel addresses via a TLB side-channel attack. lukasmaar.github.io/papers/useni...

Linux kernel Rust module for rootkit detection Article by Antoine Doglioli about implementing an in-kernel detector for many existing rootkits. The detector is written in Rust. blog.thalium.re/posts/linux-...

Linux kernel hfsplus slab-out-of-bounds Write Outstanding article by Attila Szasz about exploiting a slab out-of-bounds bug in the HFS+ filesystem driver. ssd-disclosure.com/ssd-advisory...

Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch V4bel posted another method of triggering modprobe for executing the modprobe_path privilege escalation technique. blog.theori.io/reviving-the...

Is this memory safety here in the room with us? @halvarflake.bsky.social posted slides for his keynote talk about the recent trends to resolve the problem of memory corruptions: existing solutions, their limitations, and trade-offs. docs.google.com/presentation...

Patch-Gapping the Google Container-Optimized OS for $0 Detailed article by h0mbre about exploiting a slab use-after-free in the network scheduler subsystem to target the COS 105 kernelCTF instance. h0mbre.github.io/Patch_Gappin...

Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793) Article by Ng Zhi Yang about exploiting a logical bug in the Arm Mali GPU driver discovered a few years ago. starlabs.sg/blog/2025/12...

Accidentally uncovering a seven years old vulnerability in the Linux kernel Article by @andersonc0d3.bsky.social about finding and analyzing a slab use-after-free vulnerability in the TCP sockets implementation. allelesecurity.com/accidentally...