Two-Shot Kernel Shellcode: Bypassing CR4 Pinning With KProbes for Linux Kernel Control-Flow Hijack to Shellcode

Original text: “Revisiting Two-Shot Kernel Shellcode Execution From Control Flow Hijacking” — zolutal, zolutal’s blog (10 February 2026). Code blocks below are reproduced verbatim with attribution captions.

Executive Summary

Andrey Konovalov’s 2017 Project Zero write-up showed a clean way to turn a control-flow hijack on the Linux kernel into shellcode execution: pivot into native_write_cr4 with…

https://core-jmp.org/2026/06/two-shot-kernel-shellcode-cr4-pinning-bypass-kprobes/