Linux Kernel Security

Some notes on the security properties of the pipe_buffer kernel object @a13xp0p0v (me) posted an article describing multiple pipe_buffer features relevant for the Linux kernel exploits that rely on this object a13xp0p0v.github.io/2026/04/20/pip…

Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs @v4bel published an article describing a complicated exploit of a race condition caused by a misuse of the cancel_work_sync() kernel API in the network subsystem v4bel.github.io/linux/2026/03/…

Walkthrough of an N-day Android GPU driver vulnerability Talk by Angus about analyzing CVE-2022-22706 — a logical bug in the Mali GPU driver that allows getting write access to read-only memory. youtube.com/watch?v=G71dB0…

The attack allows leaking addresses of exploitation-relevant kernel allocations. Lukas also published the source code for executing the attack. github.com/lukasmaar/kern…

From KernelSnitch to Practical msg_msg/pipe_buffer Heap KASLR Leaks Article by Lukas Maar about evaluating the KernelSnitch timing side-channel attack on a variety of systems, including Android. lukasmaar.github.io/posts/heap-kas…

The LLM was used to discover multiple 0-days in the Linux kernel and also write privilege escalation exploits for a few previously known vulnerabilities; the article provides a detailed write-up for two such exploits.

Assessing Claude Mythos Preview’s cybersecurity capabilities Article by Nicholas Carlini et. al about the security research capabilities of the new Anthropic's LLM called Claude Mythos Preview. red.anthropic.com/2026/mythos-pr…

The new mode leverages a Clang 22 feature called "allocation tokens". Unlike RANDOM_KMALLOC_CACHES, this mode deterministically assigns caches to allocations based on their types, and not allocation sites.

slab: support for compiler-assisted type-based slab cache partitioning @maelver posted a kernel patch that provides an alternative mode to RANDOM_KMALLOC_CACHES called TYPED_KMALLOC_CACHES. @google.com/" target="_blank" rel="nofollow noopener">lore.kernel.org/all/2026033111…

CrackArmor: Multiple vulnerabilities in AppArmor Article about a variety of vulnerabilities found in the AppArmor LSM implementation, including a few kernel memory corruptions. Authors exploited them to achieve LPE on Ubuntu and Debian. cdn2.qualys.com/advisory/2026/…

The implemented exploit was used to pwn the kernelCTF mitigation-v4-6.6 instance. The exploit bypasses CONFIG_RANDOM_KMALLOC_CACHES and CONFIG_SLAB_VIRTUAL. github.com/google/securit…

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets Excellent article by Quang Le about exploiting CVE-2025-38617 — a race condition that leads to a use-after-free in the packet sockets implementation. blog.calif.io/p/a-race-withi…

Analysis of the Linux kernel bugfixes @GuanniQu posted a detailed analysis: 1⃣ Kernel bugs hide for 2 years on average. Some hide for 20. pebblebed.com/blog/kernel-bu… 2⃣ Who Writes the Bugs? A Deeper Look at 125,000 Kernel Vulnerabilities. pebblebed.com/blog/kernel-bu…

The researcher glitched the setresuid syscall handler to bypass its checks and obtain the UID of 0. Bypassing SELinux via glitching remains to be investigated.

setresuid(⚡): Glitching Google's TV Streamer from adb to root. Talk by @tieknimmers about glitching the kernel of Android-based Google TV Streamer to escalate privileges via Electromagnetic Fault Injection. Slides: hardwear.io/netherlands-20… Video: youtube.com/watch?v=-w5mpX…

[Cryptodev-linux] Page-level UAF exploitation @nasm_re posted an article about exploiting a page-level UAF in the out-of-tree cryptodev-linux driver. The researcher modified struct file sprayed into a freed page to escalate privileges. nasm.re/posts/cryptode…

Authors found multiple Android vendor drivers affected by the issue. They also wrote an exploit for the IMG DXT GPU driver to escalate privileges on Pixel 10.

Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers Talk by @1ce0ear and @jmartijnb about a new type of logical bugs in kernel driver mmap handlers exploitable via the ptrace functionality. Slides: powerofcommunity.net/2025/slide/x-8… Video: youtube.com/watch?v=yAUJFr…

Seth used the bug to escalate privileges from the mediacodec SELinux context and obtain root on Pixel 9. This exploit is a part of an RCE chain developed by Seth and @natashenka. projectzero.google/2026/01/pixel-…

A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave Article by @__sethJenkins about exploiting a use-after-free in the driver for BigWave — an AV1 decoding hardware component present on Pixel SOCs. projectzero.google/2026/01/pixel-…