Linux Kernel Security

Recent Page Cache Corruption Bugs

Multitude of vulnerabilities that allow overwriting the page cache and thus changing the in-memory contents of read-only files to gain LPE or escape a container in certain scenarios.

All stem from kernel code paths that perform in-place overwrites of user-supplied input pages without verifying that the pages are writable.

Copy Fail (CVE-2026-31431):

— Announcement;
— Better write-up.

Dirty Frag (CVE-2026-43284 and CVE-2026-43500):

— Covers two independent vulnerabilities that do not require chaining;
— CVE-2026-43284 is alternatively titled Copy Fail 2;
— Original write-up;
— Avoiding bruteforcing for CVE-2026-43500.

Fragnesia (CVE-2026-46300):

— Original report;
— Variant.

DirtyCBC / DirtyDecrypt (CVE-2026-31635?):

— Write-up;
— Another exploit.

Some notes on the security properties of the pipe_buffer kernel object

a13xp0p0v (me) posted an article about a few experiments with the pipe_buffer kernel object within his kernel-hack-drill project.

Alexander described multiple pipe_buffer features relevant for kernel exploits that rely on this object.

Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs

Hyunwoo Kim published an article describing a complicated exploit of a race condition caused by a misuse of the cancel_work_sync() kernel API in the network subsystem.

Walkthrough of an N-day Android GPU driver vulnerability

Talk by Angus about analyzing CVE-2022-22706 — a logical bug in the Mali GPU driver that allows getting write access to read-only memory.

From KernelSnitch to Practical msg_msg/pipe_buffer Heap KASLR Leaks

Article by Lukas Maar about evaluating the KernelSnitch timing side-channel attack on a variety of systems, including Android.

The attack allows leaking addresses of exploitation-relevant kernel allocations.

Lukas also published the source code for executing the attack.

Assessing Claude Mythos Preview’s cybersecurity capabilities

Article by Nicholas Carlini et. al about the security research capabilities of the new Anthropic's LLM called Claude Mythos Preview.

The LLM was used to discover multiple 0-days in the Linux kernel and also write privilege escalation exploits for a few previously known vulnerabilities; the article provides a detailed write-up for two such exploits.

slab: support for compiler-assisted type-based slab cache partitioning

Marco Elver posted a kernel patch that provides an alternative mode to RANDOM_KMALLOC_CACHES called TYPED_KMALLOC_CACHES.

The new mode leverages a Clang 22 feature called "allocation tokens". Unlike RANDOM_KMALLOC_CACHES, this mode deterministically assigns caches to allocations based on their types, and not allocation sites.

CrackArmor: Multiple vulnerabilities in AppArmor

Article about a variety of vulnerabilities found in the AppArmor LSM implementation, including a few kernel memory corruptions. Authors exploited them to achieve LPE on Ubuntu and Debian.

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets

Excellent article by Quang Le about exploiting CVE-2025-38617 — a race condition that leads to a use-after-free in the packet sockets implementation.

The implemented exploit was used to pwn the kernelCTF mitigation-v4-6.6 instance. The exploit bypasses CONFIG_RANDOM_KMALLOC_CACHES and CONFIG_SLAB_VIRTUAL.

Analysis of Linux kernel bug fixes

Jenny Guanni Qu posted a detailed analysis of bug fixes in the Linux kernel:

▪️ Part 1: Kernel bugs hide for 2 years on average. Some hide for 20.

▪️ Part 2: Who Writes the Bugs? A Deeper Look at 125,000 Kernel Vulnerabilities

setresuid(⚡): Glitching Google's TV Streamer from adb to root.

Talk (slides) by Niek Timmers about glitching the kernel of the Android-based Google TV Streamer device to escalate privileges via Electromagnetic Fault Injection.

The researcher glitched the setresuid syscall handler to bypass its checks and obtain the UID of 0. Bypassing SELinux via glitching remains to be investigated.

[Cryptodev-linux] Page-level UAF exploitation

nasm_re posted an article about exploiting a page-level UAF in the out-of-tree cryptodev-linux driver. The researcher modified struct file sprayed into a freed page to escalate privileges.

Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers

Talk (slides) by Xingyu Jin and Martijn Bogaard about a new type of logical bugs in kernel driver mmap handlers exploitable via the ptrace functionality.

Authors found multiple Android vendor drivers affected by the issue. They also wrote an exploit for the IMG DXT GPU driver to escalate privileges on Pixel 10.

A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave

Article by Seth Jenkins about exploiting a use-after-free in the driver for BigWave — an AV1 decoding hardware component present on Pixel SOCs.

Seth used the bug to escalate privileges from the mediacodec SELinux context and obtain root on Pixel 9.

This exploit is a part of an RCE chain developed by Seth and Natalie Silvanovich.

Article series about exploiting CVE-2025-38352

Faith posted three articles about exploiting a race condition in the implementation of POSIX CPU timers.

Part 1️⃣ describes reproducing this race condition.

Part 2️⃣ explains how to extend the race window (a period of time when the race can be triggered).

Part 3️⃣ shows a complex PoC exploit for the UAF caused by this race condition.

Dangling pointers, fragile memory — from an undisclosed vulnerability to Pixel 9 Pro privilege escalation

Article about analyzing and exploiting a race condition that leads to a double-free in the Arm Mali GPU driver.

mediatek? more like media-rekt, amirite.

Article by hypr covering an assortment of bugs the author found in the MediaTek MT76xx and MT7915 Wi-Fi drivers.

The article also describes the nonsensical responses MediaTek gave to the bug reports, seemingly trying to weasel out of assigning a High impact rating to the reported bugs.

CVE-2025-68260: rust_binder: fix race condition on death_list

First CVE was registered for the new Binder kernel driver written in Rust. The vulnerability is a race condition caused by a list operation in an unsafe code block.