Linux Kernel Exploitation
A collection of links related to Linux kernel security and exploitation.
Updated bimonthly. Pull requests are welcome as well.
Follow @andreyknvl on X, @[email protected] on Mastodon, or @andreyknvl on Bluesky to be notified of updates.
Subscribe to @linkersec on Telegram, X, Mastodon, Bluesky, or Reddit for highlights.
Trainings
See xairy.io/trainings/.
Contents
Books
2022: “Gray Hat Hacking: The Ethical Hacker’s Handbook, Sixth Edition” [book] [materials]
2014: “Android Hacker’s Handbook” by Joshua J. Drake [book]
2012: “A Guide to Kernel Exploitation: Attacking the Core” by Enrico Perla and Massimiliano Oldani [book] [materials]
Techniques
Exploitation
2026: “Harvest Season for SLUB: From io_uring vulnerability to Novel Sheaf-Based Exploitation Techniques” by Hao-Yu Yang and Yu-Ting Lin [article]
2026: “SheafJack: Advanced Kernel 7.0 Exploitation via slab_sheaf Allocation Hijack” by Antonius [slides] [exploit] [CVE-2026-46215]
2026: “Introduction to Linux Kernel Exploitation” [article] [part 2] [part 3] [part 4]
2026: “Discovering, characterizing and exploiting controllable-copy objects for kernel data-only attacks with CopyKat” by Jakob Koschel et al. [paper]
2026: “socket(0,2,0) - Reviving modprobe_path again” by leo_something and BitFriends [article]
2026: “Kernel-Exploit-Dojo” [code]
2026: “Kernel-Hack-Drill Masterclass” by Alexander Popov [video]
2026: “PhantomMap: GPU-Assisted Kernel Exploitation” by Jiayi Hu et al. [paper] [slides] [video]
2026: “Some notes on the security properties of the pipe_buffer kernel object” by Alexander Popov [article]
2026: “Cross-Cache Attacks for the Linux Kernel via PCP Massaging” by Claudio Migliorelli et al. [paper]
2026: “Heap Localization: Cache Side-Channel based Linux Kernel Heap Exploit Techniques” by Yoochan Lee et al. [paper]
2026: “Improving Linux Heap Exploit Reliability with FreshSlices and CPU-Bullying” [article]
2026: “DIRTYFREE: Simplified Data-Oriented Programming in the Linux Kernel” [paper]
2026: “Table Manners: Diving into Linux pagetables exp techniques” by Lau [slides]
2025: “CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel” by Dong-ok Kim et al. [paper] [exploit]
2025: “BRIDGEROUTER: Automated Capability Upgrading of Out-Of-Bounds Write Vulnerabilities to Arbitrary Memory Write Primitives in the Linux Kernel” [paper]
2025: “Extending Kernel Race Windows Using ‘/dev/shm’” by Faith [article]
2025: “System Register Hijacking: Compromising Kernel Integrity By Turning System Registers Against the System” [paper]
2025: “Linux Kernel Exploitation for Beginners” by Kevin Massey [slides] [video]
2025: “KernelGP: Racing Against the Android Kernel” by Chariton Karamitas [video]
2025: “Control Flow Hijacking in the Linux Kernel” by Valeriy Yashnikov [slides] [video]
2025: “Kernel Exploitation Techniques: Turning The (Page) Tables” by Samuel Page [article]
2025: “Linux Kernel Exploitation series” by r1ru [articles] [code]
2025: “Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch” [article]
2025: “WHEN GOOD KERNEL DEFENSES GO BAD: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks” by Lukas Maar et al. [paper] [artifacts] [github]
2025: “Cross Cache Attack CheetSheet” by Pumpkin Chang [article]
2024: “Cross Cache for Lazy People – The Padding Spray Method” [article]
2024: “Linux Kernel Use Pipe Object to Do Data-Only Attack” by Pumpkin Chang [article]
2024: “CTF-style Tricks of Linux Kernel Exploitation” by Pumpkin Chang [article] [part 2]
2024: “Linux Kernel exploitation cheatsheet” by Pumpkin Chang [article]
2024: “SLUB Internals for Exploit Developers” by Andrey Konovalov [slides] [video]
2024: “SCAVY: Automated Discovery of Memory Corruption Targets in Linux Kernel for Privilege Escalation” [paper]
2024: “PageJack: A Powerful Exploit Technique With Page-Level UAF” by Zhiyun Qian et al. [slides] [video] [code] [summary]
2024: “SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache Attacks within the Linux Kernel” by Lukas Maar et al. [paper]
2024: “Linux Kernel Exploitation - ret2usr” by Sascha Schirra [article]
2024: “Binary Exploitation Notes: Kernel” by Andrej Ljubic [articles]
2024: “Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation” [paper]
2024: “GhostRace: Exploiting and Mitigating Speculative Race Conditions” [paper]
2024: “K-LEAK: Towards Automating the Generation of Multi-Step Infoleak Exploits against the Linux Kernel” [paper]
2024: “Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems” [paper]
2023: “Deep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernel” by Yudai Fujiwara [slides] [video]
2023: “D^ 3CTF2023 d3kcache: From null-byte cross-cache overflow to infinite arbitrary read & write.” [article]
2023: “No Tux Given: Diving Into Contemporary Linux Kernel Exploitation” by sam4k [slides]
2023: “Linux Kernel Exploitation series” by santaclz [article] [part2] [part 3]
2023: “RetSpill: Igniting User-Controlled Data to Burn Away Linux Kernel Protections” [paper]
2023: “Understanding Dirty Pagetable - m0leCon Finals 2023 CTF Writeup” [article]
2023: “Abusing RCU callbacks with a Use-After-Free read to defeat KASLR” [article]
2023: “Evils in the Sparse Texture Memory: Exploit Kernel Based on Undefined Behaviors of Graphic APIs” [slides] [abstract]
2023: “Make KSMA Great Again: The Art of Rooting Android devices by GPU MMU features” by Yong Wang [video] [slides]
2023: “A new method for container escape using file-based DirtyCred” by Choo Yi Kai [article]
2023: “prctl anon_vma_name: An Amusing Linux Kernel Heap Spray” by Cherie-Anne Lee [article]
2023: “Dirty Pagetable: A Novel Exploitation Technique To Rule Linux Kernel” by Nicolas Wu [article]
2023: “Exploit Engineering – Attacking the Linux Kernel” by Alex Plaskett and Cedric Halbronn [slides] [video]
2023: “Algorithmic Heap Layout Manipulation in the Linux Kernel” by Max Ufer and Daniel Baier [paper] [artifacts]
2023: “The Return of Stack Overflows in the Linux Kernel” by Davide Ornaghi [slides] [video]
2023: “Exploiting null-dereferences in the Linux kernel” by Seth Jenkins [article]
2023: “PSPRAY: Timing Side-Channel based Linux Kernel Heap Exploitation Technique” [paper] [video]
2023: “Linux Kernel PWN | 06 DirtyCred” [article]
2023: “Linux Kernel PWN | 05 ret2dir” [article]
2022: “Ret2page: The Art of Exploiting Use-After-Free Vulnerabilities in the Dedicated Cache” [slides] [video]
2022: “Devils Are in the File Descriptors: It Is Time To Catch Them All” by Le Wu [slides] [video]
2022: “FUSE for Linux Exploitation 101” [article]
2022: “Kernel Exploit Recipes” [brochure]
2022: “pipe_buffer arbitrary read write” by Jayden R [article]
2022: “Joy of exploiting the Kernel” [slides]
2022: “An exploit primitive in the Linux kernel inspired by DirtyPipe” [article]
2022: “DirtyCred: Escalating Privilege in Linux Kernel” [paper] [slides] [artifacts]
2022: “DirtyCred: Cautious! A New Exploitation Method! No Pipe but as Nasty as Dirty Pipe” [slides] [artifacts]
2022: “CoRJail: From Null Byte Overflow To Docker Escape Exploiting poll_list Objects In The Linux Kernel” [article]
2022: “Reviving Exploits Against Cred Structs - Six Byte Cross Cache Overflow to Leakless Data-Oriented Kernel Pwnage” [article]
2022: “USMA: Share Kernel Code With Me” by Yong Liu et al. [slides] [video] [paper] [article]
2022: “Linux kernel heap feng shui in 2022” by Michael S and Vitaly Nikolenko [article]
2022: “LiKE: A Series on Linux Kernel Exploitation” by sam4k [article] [modprobe_path]
2022: “Racing against the clock – hitting a tiny kernel race window” by Jann Horn [article]
2022: “Playing for K(H)eaps: Understanding and Improving Linux Kernel Exploit Reliability” [paper] [artifacts]
2022: “Learning Linux kernel exploitation” by 0x434b [article] [part 2]
2021: “ExpRace: Exploiting Kernel Races through Raising Interrupts” at USENIX [paper] [slides] [video]
2021: “Utilizing msg_msg Objects for Arbitrary Read and Arbitrary Write in the Linux Kernel” [article] [part2]
2021: “Linux Kernel Exploitation Technique: Overwriting modprobe_path” [article]
2021: “Learning Linux Kernel Exploitation” [article] [part 2] [part 3]
2020: “PTMA (Page Table Manipulation Attack): Attacking the core of memory permission” [slides]
2020: “Exploiting Kernel Races Through Taming Thread Interleaving” [slides] [video]
2020: “Locating the kernel PGD on Android/aarch64” by Vitaly Nikolenko [article]
2020: “A Systematic Study of Elastic Objects in Kernel Exploitation” [paper] [video]
2020: “Exploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers” [slides] [paper] [video]
2020: “BlindSide: Speculative Probing: Hacking Blind in the Spectre Era” [paper]
2020: “Linux Kernel Stack Smashing” by Silvio Cesare [article]
2020: “Structures that can be used in kernel exploits” [article]
2019: “The Route to Root: Container Escape Using Kernel Exploitation” by Nimrod Stoler [article]
2019: “Linux Kernel: the ROP Exploit of Stack Overflow in Android Kernel” [article]
2019: “Hands Off and Putting SLAB/SLUB Feng Shui in Blackbox” by Yueqi (Lewis) Chen at Black Hat Europe [slides] [code]
2019: “SLAKE: Facilitating Slab Manipulation for Exploiting Vulnerabilities in the Linux Kernel” by Yueqi (Lewis) Chen and Xinyu Xing [slides] [paper]
2019: “Exploiting Race Conditions Using the Scheduler” by Jann Horn at Linux Security Summit EU [slides] [video]
2019: “Kepler: Facilitating Control-flow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities” [slides] [video] [paper]
2019: “Leak kernel pointer by exploiting uninitialized uses in Linux kernel” by Jinbum Park [slides]
2019: “Kernel IDT priviledge escalation” [article]
2018: “FUZE: Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities” [slides] [paper]
2018: “Linux Kernel universal heap spray” by Vitaly Nikolenko [article]
2018: “Linux-Kernel-Exploit Stack Smashing” [article]
2018: “Entering God Mode - The Kernel Space Mirroring Attack” [article]
2018: “Mirror Mirror: Rooting Android 8 with a Kernel Space Mirroring Attack” by Wang Yong at HitB [slides]
2018: “KSMA: Breaking Android kernel isolation and Rooting with ARM MMU features” by Wang Yong at BlackHat [slides]
2018: “Still Hammerable and Exploitable: on the Effectiveness of Software-only Physical Kernel Isolation” [paper]
2018: “linux kernel pwn notes” [article]
2018: “Use of timer_list structure in linux kernel exploit” [article]
2018: “Entering God Mode — The Kernel Space Mirroring Attack” [article]
2017: “Escalating Privileges in Linux using Fault Injection” by Niek Timmers and Cristofaro Mune [slides] [video] [paper]
2017: “Kernel Driver mmap Handler Exploitation” by Mateusz Fruba [paper]
2017: “Linux kernel addr_limit bug / exploitation” by Vitaly Nikolenko [video]
2017: “The Stack Clash” by Qualys Research Team [article]
2017: “New Reliable Android Kernel Root Exploitation Techniques” [slides]
2017: “Unleashing Use-Before-Initialization Vulnerabilities in the Linux Kernel Using Targeted Stack Spraying” [paper]
2017: “Breaking KASLR with perf” by Lizzie Dixon [article]
2017: “Linux kernel exploit cheetsheet” [article]
2016: “Getting Physical Extreme abuse of Intel based Paging Systems” by Nicolas Economou and Enrique Nissim [slides]
2016: “Linux Kernel ROP - Ropping your way to # (Part 1)” by Vitaly Nikolenko [article] [exercise]
2016: “Linux Kernel ROP - Ropping your way to # (Part 2)” by Vitaly Nikolenko [article]
2016: “Exploiting COF Vulnerabilities in the Linux kernel” by Vitaly Nikolenko at Ruxcon [slides]
2016: “Using userfaultfd” by Lizzie Dixon [article]
2016: “Direct Memory Attack the Kernel” by Ulf Frisk at DEF CON [video]
2016: “Randomization Can’t Stop BPF JIT Spray” by Elena Reshetova at Black Hat [slides] [video] [paper]
2015: “Kernel Data Attack is a Realistic Security Threat” [paper]
2015: “From Collision To Exploitation: Unleashing Use-After-Free Vulnerabilities in Linux Kernel” [paper]
2015: “Modern Binary Exploitation: Linux Kernel Exploitation” by Patrick Biernat [slides] [exercise]
2013: “Hacking like in the Movies: Visualizing Page Tables for Local Exploitation” at Black Hat
2013: “Exploiting linux kernel heap corruptions” by Mohamed Channam [article]
2012: “Writing kernel exploits” by Keegan McAllister [slides]
2012: “Understanding Linux Kernel Vulnerabilities” by Richard Carback [slides]
2012: “A Heap of Trouble: Breaking the Linux Kernel SLOB Allocator” by Dan Rosenberg [paper]
2012: “Attacking hardened Linux systems with kernel JIT spraying” by Keegan McAllister [article] [code 1] [code 2]
2012: “The Linux kernel memory allocators from an exploitation perspective” by Patroklos Argyroudis [article]
2012: “The Stack is Back” by Jon Oberheide [slides]
2012: “Stackjacking” by Jon Oberheide and Dan Rosenberg [slides]
2011: “Stackjacking Your Way to grsec/PaX Bypass” by Jon Oberheide [article]
2010: “Much ado about NULL: Exploiting a kernel NULL dereference” [article]
2010: “Exploiting Stack Overflows in the Linux Kernel” by Jon Oberheide [article]
2010: “Linux Kernel Exploitation: Earning Its Pwnie a Vuln at a Time” by Jon Oberheide at SOURCE Boston [slides]
2009: “There’s a party at ring0, and you’re invited” by Tavis Ormandy and Julien Tinnes at CanSecWest [slides]
2007: “Kernel-mode exploits primer” by Sylvester Keil and Clemens Kolbitsch [paper]
2007: “Attacking the Core : Kernel Exploiting Notes” [article]
2007: “The story of exploiting kmalloc() overflows” [article]
2007: “Linux 2.6 Kernel Exploits” by Stephane Duverger [slides]
2005: “Large memory management vulnerabilities” by Gael Delalleau at CanSecWest [slides]
2005: “The story of exploiting kmalloc() overflows” [article]
Protection Bypasses
2026: “Fence2Pwn: KFENCE-Enabled Kernel Exploitation Bypassing Slab Hardening and Memory Tagging” by Ernesto Martinez Garcia et al. [paper] [slides] [video]
2026: “Revisiting Two-Shot Kernel Shellcode Execution From Control Flow Hijacking” by Jennifer Miller [article]
2025: “Defeating KASLR by Doing Nothing at All” by Seth Jenkins [article]
2025: “The Journey of Bypassing Ubuntu’s Unprivileged Namespace Restriction” by Pumpkin Chang [article]
2025: “Exploring Kernel Address Leakage via WARN()” by Pumpkin Chang [article]
2025: “Three bypasses of Ubuntu’s unprivileged user namespace restrictions” by Qualys Research Team [article]
2025: “A hole in FineIBT protection” by Jonathan Corbet [article]
2024: “SELinux bypasses” [article]
2024: “Page-Oriented Programming: Subverting Control-Flow Integrity of Commodity Operating System Kernels with Non-Writable Code Pages” by Seunghun Han et al. [paper] [slides] [video]
2024: “Defects-in-Depth: Analyzing the Integration of Effective Defenses against One-Day Exploits in Android Kernels” by Lukas Maar et al. [paper] [artifacts]
2024: “Leaking Host KASLR from Guest VMs Using Tagged TLB” by Reno Robert [article]
2024: “TikTag: Breaking ARM’s Memory Tagging Extension with Speculative Execution” by Juhee Kim et al. [paper] [code]
2023: “A Closer Look At Freelist Hardening” by Matt Yurkewych [article] [slides]
2023: “Leaky Address Masking: Exploiting Unmasked Spectre Gadgets with Noncanonical Address Translation” [paper]
2023: “MTE As Implemented, Part 3: The Kernel” by Mark Brand [article]
2023: “Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented Programming” by Seunghun Han [slides]
2023: “EPF: Evil Packet Filter” by Di Jin et al. [paper]
2023: “Bypassing SELinux with init_module” by Sean Pesce [article]
2023: “Finding Gadgets for CPU Side-Channels with Static Analysis Tools” by Jordy Zomer and Alexandra Sandulescu [article]
2023: “Linux Kernel: Spectre-v1 gadgets” by Jordy Zomer and Alexandra Sandulescu [article]
2023: “Linux Kernel: Spectre v2 SMT mitigations problem” by Eduardo Vela [article]
2022: “A Dirty Little History: Bypassing Spectre Hardware Defenses to Leak Kernel Data” [slides]
2022: “Tetragone: A Lesson in Security Fundamentals” by Pawel Wieczorkiewicz and Brad Spengler [article]
2021: “Characterizing, Exploiting, and Detecting DMA Code Injection Vulnerabilities in the Presence of an IOMMU” [paper]
2021: “A General Approach to Bypassing Many Kernel Protections and its Mitigation” by Yueqi Chen [slides] [video]
2021: “Attacking Samsung RKP” by Alexandre Adamski [article]
2020: “Things not to do when using an IOMMU” by Ilja van Sprundel and Joseph Tartaro [video]
2020: “SELinux RKP misconfiguration on Samsung S20 devices” by Vitaly Nikolenko [article]
2020: “TagBleed: Breaking KASLR on the Isolated Kernel Address Space using Tagged TLBs” [paper]
2020: “Weaknesses in Linux Kernel Heap Hardening” by Silvio Cesare [article]
2020: “An Analysis of Linux Kernel Heap Hardening” by Silvio Cesare [article]
2020: “PAN: Another day, another broken mitigation” by Siguza [article]
2019: “KNOX Kernel Mitigation Bypasses” by Dong-Hoon You at PoC [slides]
2017: “Lifting the (Hyper) Visor: Bypassing Samsung’s Real-Time Kernel Protection” by Gal Beniamini [article]
2016: “Linux Kernel x86-64 bypass SMEP - KASLR - kptr_restric” [article]
2016: “Practical SMEP bypass techniques on Linux” by Vitaly Nikolenko at KIWICON [slides]
2016: “Micro architecture attacks on KASLR” by Anders Fogh [article]
2016: “Jump Over ASLR: Attacking Branch Predictors to Bypass ASLR” by Dmitry Evtyushkin et al. [slides]
2016: “Prefetch Side-Channel Attacks: Bypassing SMAP and Kernel ASLR” by Daniel Gruss et al. at CCS [video]
2016: “Using Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process” at Black Hat [video]
2016: “Breaking KASLR with Intel TSX” Yeongjin Jang, Sangho Lee and Taesoo Kim at Black Hat [slides] [video]
2016: “Breaking KASLR with micro architecture” by Anders Fogh [article]
2015: “Effectively bypassing kptr_restrict on Android” by Gal Beniamini [article]
2014: “ret2dir: Deconstructing Kernel Isolation” by Vasileios P. Kemerlis et al. at Black Hat Europe [paper] [video]
2013: “A Linux Memory Trick” by Dan Rosenberg [article]
2011: “SMEP: What is It, and How to Beat It on Linux” by Dan Rosenberg [article]
2009: “Bypassing Linux’ NULL pointer dereference exploit prevention (mmap_min_addr)” [article]
Vulnerabilities
Project Zero bug reports
Google kernelCTF writeups and exploits
Assorted advisories by Gyorgy Miru and kutyacica
Info-leaks
2026: “From KernelSnitch to Practical msg_msg/pipe_buffer Heap KASLR Leaks” by Lukas Maar [article] [code]
2025: “CVE-2023-26083: Kernel Pointer Leakage in Mali GPU’s Timeline Stream Message Buffers” [article] [CVE-2023-26083]
2025: “Vulnerabilities in the /proc Component of the CAN BCM Protocol in the Linux kernel” by Anderson Nascimento [slides] [CVE-2023-52922] [CVE-2025-38003] [CVE-2025-38004]
2025: “Use-after-free in CAN BCM subsystem leading to information disclosure (CVE-2023-52922)” [article] [CVE-2023-52922]
2025: “KernelSnitch: Side-Channel Attacks on Kernel Data Structures” by Lukas Maar et al. [paper] [slides]
2024: “Linux vDSO & VVAR” by Pumpkin Chang [article] [CVE-2023-23586]
2024: “CPU Speculation Vulnerabilities And Mitigations in the Linux Kernel” by Pumpkin Chang [article] [Spectre V1] [Spectre V2]
2024: “Linux Kernel Meltdown Mitigation Analysis” by Pumpkin Chang [article] [Meltdown]
2024: “Out of the kernel, into the tokens” by Max Ammann and Emilio Lopez [article]
2023: “The code that wasn’t there: Reading memory on an Android device by accident” by Man Yue Mo [article] [CVE-2022-25664]
2023: “EntryBleed: A Universal KASLR Bypass against KPTI on Linux” [paper] [CVE-2022-4543]
2022: “EntryBleed: Breaking KASLR under KPTI with Prefetch (CVE-2022-4543)” [article] [CVE-2022-4543]
2022: “Yet another bug into Netfilter” by Arthur Mongodin [article] [CVE-2022-1972]
2022: “The AMD Branch (Mis)predictor: Just Set it and Forget it!” by Pawel Wieczorkiewicz [article] [Spectre]
2022: “The AMD Branch (Mis)predictor Part 2: Where No CPU has Gone Before (CVE-2021-26341)” by Pawel Wieczorkiewicz [article] [Spectre]
2021: “Samsung S10+/S9 kernel 4.14 (Android 10) Kernel Function Address (.text) and Heap Address Information Leak” [article] [CVE-UNKNOWN]
2021: “Linux Kernel /proc/pid/syscall information disclosure vulnerability” [article] [CVE-2020-28588]
2021: “Spectre exploits in the “wild”” [article]
2021: “VDSO As A Potential KASLR Oracle” by Philip Pettersson and Alex Radocea [article]
2020: “PLATYPUS: Software-based Power Side-Channel Attacks on x86” [paper]
2019: “CVE-2018-3639 / CVE-2019-7308 - Analysis of Spectre Attacking Linux Kernel ebpf” [article] [CVE-2018-3639, CVE-2019-7308]
2019: “From IP ID to Device ID and KASLR Bypass (Extended Version)” [paper]
2018: “Kernel Memory disclosure & CANVAS Part 1 - Spectre: tips & tricks” [article] [Spectre]
2018: “Kernel Memory disclosure & CANVAS Part 2 - CVE-2017-18344 analysis & exploitation notes” [article] [CVE-2017-18344]
2018: “CVE-2017-18344: Exploiting an arbitrary-read vulnerability in the Linux kernel timer subsystem” by Andrey Konovalov [article] [CVE-2017-18344]
2017: “Linux kernel 2.6.0 to 4.12-rc4 infoleak due to a data race in ALSA timer” by Alexander Potapenko [announcement] [CVE-2017-1000380]
2017: “The Infoleak that (Mostly) Wasn’t” by Brad Spengler [article] [CVE-2017-7616]
2016: “Exploiting a Linux Kernel Infoleak to bypass Linux kASLR” [article]
2010: “Linux Kernel pktcdvd Memory Disclosure” by Jon Oberheide [article] [CVE-2010-3437]
2009: “Linux Kernel x86-64 Register Leak” by Jon Oberheide [article] [CVE-2009-2910]
2009: “Linux Kernel getname() Stack Memory Disclosures” by Jon Oberheide [article] [CVE-2009-3001]
LPE
2026: “Viral Vulnerabilities: Unpacking Copy.Fail and related Linux Kernel bugs” by Angus [video] [CVE-2026-31431] [CVE-2026-43284] [CVE-2026-43500] [CVE-2026-46300]
2026: “Dangerous Device: Exploiting CVE-2026-31695 in the Linux Kernel via struct device” by Alexander Popov [article] [slides] [CVE-2026-31695]
2026: “Kernel UaF to Root” by Quentin Buathier [article] [part 2] [part 3] [part 4] [CVE-2023-20938]
2026: “Bad UVM” by Ziyi Guo [article] [CVE-UNKNOWN]
2026: “No Time to Pwn: CVE-2026-72018” by Baul Lee [article] [CVE-2026-72018]
2026: “Porting ghostlock (CVE-2026-43499) to the Samsung Galaxy A17: KDP, DEFEX, and the art of not panicking” [article] [exploit] [CVE-2026-43499]
2026: “When Defenses Become Attack Surface: CVE-2026-20971, a Samsung Kernel UAF” [article] [CVE-2026-20971]
2026: “How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail” by Muhammad Alifa Ramdhan and Billy Jheng Bing-Jhong [article] [exploit] [CVE-2025-39964]
2026: “Containers Are No Longer a Security Boundary” by Zhenpeng (Leo) Lin [article] [exploit] [CVE-2026-80521] [CVE-2026-52910]
2026: “A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill” by Asim Viladi Oglu Manizada [article] [exploit] [exploit] [exploit] [exploit] [CVE-2026-80844] [CVE-2026-81000] [CVE-2026-68121] [CVE-2026-74469]
2026: “Exploiting CVE-2026-53264 with One Function on v7.1-rc5” by b1n [article] [CVE-2026-53264]
2026: “Route of Root: Bring a "DoS only" bug to LPE and bypass the existing patch to win $10,500 in kernelCTF” [article] [exploit] [CVE-2026-43501]
2026: “SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free” [article] [CVE-2026-64564]
2026: “[Linux RDMA/rxe] From kref_get to root: exploitation of CVE-2026-64582” by nasm [article] [exploit] [CVE-2026-64582]
2026: “Exploiting Mali GPU via the Dirty Pagetable on a Pixel 7 Pro” by Kuzey Arda Bulut [article] [exploit] [CVE-2025-8045]
2026: “Linux Bridge STP Timer Use-After-Free” [article] [CVE-UNKNOWN]
2026: “RefluXFS: Local Privilege Escalation via XFS reflink direct-I/O race (CVE-2026-64600)” by Qualys Research Team [article] [CVE-2026-64600]
2026: “Frag Gap” by qwerty [article] [exploit] [CVE-2026-53362]
2026: “A Linux Kernel 0-day Journey - From a limited UAF to Physical Memory R/W” by kiks [article] [CVE-UNKNOWN]
2026: “I handed the epoll UAF to an agent” by Guy Beck [article] [CVE-2026-46242]
2026: IonStack part III: Rooting Android 17 with GhostLock [article] exploit] [CVE-2026-43499]
2026: IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years [article] [CVE-2026-43499]
2026: “Dissecting and Exploiting Linux LPE Variant: DirtyClone (CVE-2026-43503)” by Eddy Tsalolikhin and Or Peles [article] [CVE-2026-43503]
2026: “19+ Years Hidden, $80,000+ Rewarded: Reporting a Linux Kernel Zero-Day for Google kernelCTF: CVE-2026-43456” by Yuki Koike and Kota Toda [article] [CVE-2026-43456]
2026: “PACKET_EDIT_MEME.c (CVE-2026-46331): yet another Page Cache Poisoning Nightmare” by Massimiliano Oldani [article] [exploit] [CVE-2026-46331]
2026: “IPV6_FRAG_ESCAPE: a unprivileged container / jail escape PoC” by Massimiliano Oldani [article] [exploit] [CVE-UNKNOWN]
2026: “PTRACE_MAY_DREAM: CVE-2026-46333, forgotten too soon, full privesc included” by Massimiliano Oldani [article] [exploit] [CVE-2026-46333]
2026: “Analysis and exploitation of CVE-2022-0995” by Felix [article] [CVE-2022-0995]
2026: “Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215)” by Stan Shaw [article] [CVE-2026-46215]
2026: “Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694)” by Stan Shaw [article] [CVE-2026-31694]
2026: “Bad Epoll: The bug missed by Mythos” by Jaeyoung Chung [article] [CVE-2026-46242]
2026: “Exploiting CVE-2024-1065 via the Page Cache” by Kuzey Arda Bulut [article] [CVE-2024-1065]
2026: “Off By !: Exploiting a Use-after-Free in the Linux Kernel” by Oliver Sieber [article] [CVE-2026-23111]
2026: “CIFSwitch: a non-universal Linux local root vulnerability” by Asim Viladi Oglu Manizada [article] [exploit] [CVE-2026-46243]
2026: “Copy Fail” [summary] [article] [exploit] [CVE-2026-31431]
2026: “CVE-2026-31431: Copy Fail” by Jorge Buzeti [article] [CVE-2026-31431] [Copy Fail]
2026: “Copy Fail: A 4-Byte Page-Cache Write LPE” by Axura [article] [exploit] [CVE-2026-31431] [Copy Fail]
2026: “AF_ALG page-cache cross-container pivot: Part I” by Massimiliano Oldani [article] [exploit] [CVE-2026-31431] [Copy Fail]
2026: “Copy Fail: From Pod to Host.” by Juno Im [article] [exploit] [CVE-2026-31431] [Copy Fail]
2026: “Dirty Frag” by Hyunwoo Kim [article] [exploit] [CVE-2026-43284] [CVE-2026-43500] [Dirty Frag]
2026: “copy fail 2: electric boogaloo” by SiCk [article] [exploit] [CVE-2026-43284] [Dirty Frag]
2026: “Discovery and Disclosure of an RxGK Variant in the Linux Kernel Privilege Escalation Vulnerability Family "Dirty Frag"” [article] [CVE-2026-43500] [Dirty Frag]
2026: “Load-Bearing Assumptions: the rxrpc case (CVE-2026-43500) and the constraint that was never there” by Massimiliano Oldani [article] [exploit] [CVE-2026-43500] [Dirty Frag]
2026: “Fragnesia” by William Bowling [article] [variant] [CVE-2026-46300] [Fragnesia]
2026: “DirtyCBC: When Linux Kernel Decrypt-Before-MAC Turns Authenticated Encryption Into a Page-Cache Write” by Kamil Leoniak [article] [CVE-UNKNOWN] [Dirty CBC] [Dirty Decrypt]
2026: “PinTheft” by Aaron Esau [article] [CVE-UNKNOWN]
2026: “From Zero To Root: Attacking Qualcomm DSP Driver” by Xiling Gong [video] [CVE-2025-47394]
2026: “Tile-Based Deferred Rooting: When Your GPU Starts Rendering To Kernel Code Space!” by Xingyu Jin and Martijn Bogaard [slides] [video] [CVE-2025-25180]
2026: “Privilege Escalation via a Page Use-After-Free in Qualcomm’s AI Accelerator Linux Kernel Driver” by Lukas Maar [article] [code] [CVE-UNKNOWN]
2026: “Damned OOB” by Mohamed Salem Eddah [article] [CVE-UNKNOWN]
2026: “Logic bug in the Linux kernel’s __ptrace_may_access() function” by Qualys Research Team [article] [CVE-2026-46333]
2026: “CVE-2026-31419: Use-After-Free in the Linux Bonding Driver” by Moe Acherir [article] [CVE-2026-31419]
2026: “CVE-2024-0582, or Easy Kernel Exploitation” by Moe Acherir [article] [CVE-2024-0582]
2026: “A 0-Click Exploit Chain For The Pixel 10” by Natalie Silvanovich and Seth Jenkins [video] [article] [CVE-UNKNOWN]
2026: “This Android kernel exploit is way too simple” by Billy Ellis [video] [CVE-UNKNOWN]
2026: “Exploring Android ROOT via CVE-2025-21479” [article] [CVE-2025-21479]
2026: “Codex Hacked a Samsung TV” [article] [CVE-UNKNOWN]
2026: “From a Netfilter Bug to kernelCTF: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10500 Bounty” [article] [CVE-2026-23274]
2026: “Reproducing CVE-2026-23111: How one character can change everything” [article] [CVE-2026-23111]
2026: “Assessing Claude Mythos Preview’s cybersecurity capabilities” [article] [CVE-2024-47711]
2026: “kernel alchemy pt. 1: developing exploit primitives with CVE-2025-20741” by hypr [article] [CVE-2025-20741]
2026: “Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs” [article] [CVE-2026-23239]
2026: “Linux Kernel CVE-2022-3910 (h0mbre kCTF bug) LPE” [article] [CVE-2022-3910]
2026: “CrackArmor: Multiple vulnerabilities in AppArmor” by Qualys Research Team [article] [CVE-UNKNOWN]
2026: “PageJack in Action: CVE-2022-0995 exploit” by Jean Vincent [article] [CVE-2022-0995]
2026: “A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets” [article] [CVE-2025-38617]
2026: “Linux Kernel net/sched CAKE Qdisc Use-After-Free LPE” by Noamr [article] [CVE-UNKNOWN]
2026: “[Cryptodev-linux] Page-level UAF exploitation” by nasm [article] [NO-CVE]
2026: “A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave” by Seth Jenkins [article] [CVE-2025-36934]
2026: “Translator/Mali Utgard Hacking” [articles] [exploits] [CVE-UNKNOWN]
2025: “Walkthrough of an N-day Android GPU driver vulnerability” by Angus [video] [CVE-2022-22706]
2025: “A tale of challenging MTE: Rooting Google Pixel with kernel MTE enabled in one shot” by Yong Wang [slides] [CVE-UNKNOWN]
2025: “CVE-2025-38352 (Part 1) - In-the-wild Android Kernel Vulnerability Analysis + PoC” by Faith [article] [CVE-2025-38352]
2025: “CVE-2025-38352 (Part 2) - Extending The Race Window Without a Kernel Patch” by Faith [article] [CVE-2025-38352]
2025: “CVE-2025-38352 (Part 3) - Uncovering Chronomaly” by Faith [article] exploit [CVE-2025-38352]
2025: “Dangling pointers, fragile memory—from an undisclosed vulnerability to Pixel 9 Pro privilege escalation” [article] [CVE-2025-6349] [CVE-2025-8045]
2025: “Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers” by Xingyu Jin and Martijn Bogaard [slides] [video] [CVE-2024-44068] [CVE-2025-23244] [CVE-2025-8109] [CVE-2024-49739]
2025: “Déjà Vu in Linux io_uring: Breaking Memory Sharing Again After Generations of Fixes” by Pumpkin Chang [slides] [video] [CVE-2025-21836]
2025: “CUDA de Grâce” by Valentina Palmiotti and Samuel Lovejoy [slides] [video] [CVE-UNKNOWN]
2025: “An RbTree Family Drama: Exploiting a Linux Kernel 0-day Through Red-Black Tree Transformations” by Savino Dicanosa and William Liu [slides] [video] [CVE-2025-38001]
2025: “Race Condition Symphony: From Tiny Idea to Pwnie” by Hyunwoo Kim and Wongi Lee [slides] [CVE-2024-50264]
2025: “Exploiting CVE-2025-21479 on a Samsung S23” by XploitBengineer [article] [CVE-2025-21479]
2025: “LPE via refcount imbalance in the af_unix of Ubuntu’s Kernel” by kylebot [article] [CVE-2025-13350]
2025: “Cracking the Pixel 8: Exploiting the Undocumented DSP to Bypass MTE” by Pan Zhenpeng and Jheng Bing Jhong [slides] [video]
2025: “DirtyPipe-CVE-2022-0847” by Abdul Qadir [article] [CVE-2022-0847]
2025: “Oops! It’s a kernel stack use-after-free: Exploiting NVIDIA’s GPU Linux drivers” by Robin Bastide [article] [CVE-2025-23280] [CVE-2025-23330]
2025: “ksmbd - Exploiting CVE-2025-37947” by Norbert Szetei [article] [CVE-2025-37947] [exploit]
2025: “Analysing a 1-day Vulnerability in the Linux Kernel’s TLS Subsystem” by Faith [article] [CVE-2025-39946] [exploit]
2025: “Analyze Linux Kernel 1-day 0aeb54ac” by Pumpkin Chang [article] [CVE-2025-39946]
2025: “Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel” by Alexander Popov [article] [CVE-2024-50264]
2025: “A Walk Through Android Physical Memory: CVE-2025-21479 Privilege Escalation” [article] [comment] [CVE-2025-21479]
2025: “netfilter: ipset: Missing Range Check LPE” [article] [CVE-2024-53141]
2025: “From Chrome renderer code exec to kernel with MSG_OOB” by Jann Horn [article] [CVE-2025-38236]
2025: “[CVE-2025-38001] Exploiting All Google kernelCTF Instances And Debian 12 With A 0-Day For $82k: An RBTree Family Drama (Part One: LTS & COS)” by D3vil [article] [CVE-2025-38001]
2025: “Linux Kernel Pipapo Set Double Free LPE” by Slavin and Le Premier Homme [article] [CVE-UNKNOWN]
2025: “The tragedy of Netfilter Tunnel: CVE-2025-22056” [article] [CVE-2025-22056]
2025: “Solo: A Pixel 6 Pro Story (When one bug is all you need)” by Lin Ze Wei [article] [CVE-2023-48409] [CVE-2023-26083]
2025: “Bypassing MTE with CVE-2025-0072” by Man Yue Mo [article] [CVE-2025-0072]
2025: “Skin in the Game: Survival of GPU IOMMU Irregular Damage” by Fish and Ling Hanqin [video] [CVE-2022-38181] [CVE-2023-6241] [CVE-2023-33107] [CVE-2024-23372] [CVE-2024-31333]
2025: “[CVE-2025-37752] Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds” by D3vil [article] [CVE-2025-37752]
[2025: “Linux Kernel Exploitation: CVE-2025-21756: Attack of the Vsock” by Michael Hoefle
README 内容过长，已截取前 64 KB。完整内容请前往 GitHub 仓库查看。
评论