Linux Kernel Security

corCTF 2025 - corphone

Article by Pumpkin about exploiting a UAF in a custom Android kernel module created for a CTF task.

The exploit gains control over the page tables and overwrites the kernel code to bypass SELinux and escalate privileges.

USB HID info-leak exploit for CVE-2025-38494/CVE-2025-38495

Exploit by Andrey Konovalov for an integer underflow bug in the HID subsystem that allows leaking up to 64 KB of kernel memory over USB.

The bug is still not fixed in the Pixel and Ubuntu kernels.

ksmbd - Fuzzing Improvements and Vulnerability Discovery

Another article by Norbert Szetei about fuzzing the ksmbd module with syzkaller.

Covers the improvements made to the fuzzer since the previous article. These improvements allowed finding an impressive amount of 23 bugs in ksmbd.

arm64: Linear mapping is mapped at the same static virtual address

Bug report by Seth Jenkins and Jann Horn showing that the physmap region is mapped at a fixed virtual address on Android despite KASLR.

Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel

Alexander Popov (me) published an article about exploiting a race condition in AF_VSOCK subsystem, the bug that received a Pwnie Award 2025.

Despite the bug collision with other researchers, Alexander found a new exploitation method for this bug by relying on his pet project kernel-hack-drill.

From Chrome renderer code exec to kernel with MSG_OOB

Jann Horn posted an article about exploiting CVE-2025-38236, a UAF in the UNIX domain sockets. The article contains many interesting notes and takeaways on writing kernel exploits that work from within the Chrome renderer sandbox.

Exploiting All Google kernelCTF Instances And Debian 12 With A 0-Day For $82k: A RBTree Family Drama

Crusaders of Rust posted an article about exploiting a UAF in the network packet scheduler. The researchers manipulated red-black trees in the kernel to achieve a page-level UAF, which they used to escalate privileges.

Debugging the Pixel 8 kernel via KGDB

Article by Andrey Konovalov about setting up KGDB on Pixel 8 for debugging its kernel.

Provides instructions for getting the kernel log over UART via USB-Cereal, building and flashing a kernel with KGDB, breaking into KGDB via /proc/sysrq-trigger or by sending SysRq-G over a serial connection, dealing with watchdogs, etc.

CVE-2023-52927 - Turning a Forgotten Syzkaller Report into kCTF Exploit

Article by Hoàng Hải Long about finding an unfixed netfilter use-after-free bug reported by syzbot. The researcher exploited it to pwn the kernelCTF COS instance.

Fuzzing Linux Kernel Modules, with Slava Moskvin

Stream by Slava Moskvin hosted by Stephen Sims about building a custom fuzzer to rediscover CVE-2025-0927 in the HFS+ filesystem implementation.

Slava started with a simple fuzzer implementation and then improved it step-by-step by adding coverage collection, proper seed generation, mutations, etc.

The source code of the fuzzer is public.

Linux Kernel Hardening: Ten Years Deep

Talk (slides) by Kees Cook about the relevance of various Linux kernel vulnerability classes and the mitigations that address them.

Bypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL

Xuan Xing & Eugene Rodionov gave a talk (slides) about fuzzing the Linux kernel interfaces fully in user space using LKL (Linux Kernel Library).

The Journey of Bypassing Ubuntu’s Unprivileged Namespace Restriction

Article by Pumpkin about the internals of the Ubuntu's implementation of restricting unprivileged user namespaces and figuring out another bypass method.

Exploiting the CVE-2025-21756 1-day vulnerability

Hyunwoo Kim and Wongi Lee posted a kernelCTF report about exploiting a UAF in the vsock subsystem of the Linux kernel.

The researchers leaked the kernel base address using the EntryBleed side-channel attack and then turned the UAF on the vsock_sock structure into a RIP control primitive to execute a ROP-chain.

Solo: A Pixel 6 Pro Story (When one bug is all you need)

Awesome article by Lin Ze Wei about adapting the Pixel 7/8 exploit for a bug in the Mali GPU driver to Pixel 6 Pro.

Bypassing MTE with CVE-2025-0072

Article by Man Yue Mo about exploiting a page use-after-free vulnerability in the ARM's Mali GPU driver in the code that manages userspace-mapped pages.

Author published an exploit for this bug that disable SELinux and gains root privileges on Pixel 8 running from the untrusted_app context. The exploit is not affected by MTE.

How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel's SMB implementation

Article by Sean Heelan about rediscovering a bug in the ksmbd module via the OpenAI's o3 model and then finding a 0-day vulnerability as well.

The researcher had to rerun the prompt multiple times before getting a true-positive result. The o3 model managed to find the 0-day vulnerability in only ~1 out of 50 runs.

Android In-The-Wild: Unexpectedly Excavating a Kernel Exploit

Talk by Seth Jenkins about analyzing the traces of an In-The-Wild exploit that targeted the Qualcomm adsprpc driver.

Based on a previously published article.