Accidentally uncovering a seven years old vulnerability in the Linux kernel

Article by Anderson Nascimento about finding and analyzing a slab use-after-free vulnerability in the TCP sockets implementation.

Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793)

Article by Ng Zhi Yang about exploiting a logical bug in the Arm Mali GPU driver discovered a few years ago.

The bug allows gaining write permissions to a read-only memory region. The article explains how to exploit this bug from the untrusted_app context on Pixel 6 to load an arbitrary kernel module to disable SELinux and spawn a root reverse shell.

Patch-Gapping the Google Container-Optimized OS for $0

Detailed article by h0mbre about exploiting a slab use-after-free in the network scheduler subsystem to target the COS 105 kernelCTF instance.

Is this memory safety here in the room with us?

Halvar Flake posted slides for his keynote talk about the recent trends to resolve the problem of memory corruptions: existing solutions, their limitations, and trade-offs.

While this talk does not directly focus on the Linux kernel, the shared points are relevant in the kernel context too.

Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch

V4bel posted another method of triggering modprobe for executing the modprobe_path privilege escalation technique. This method relies on AF_ALG sockets instead of creating a special executable file.

Linux kernel hfsplus slab-out-of-bounds Write

Outstanding article by Attila Szasz about exploiting a slab out-of-bounds bug in the HFS+ filesystem driver.

The author discovered that Ubuntu allows local (not remote/SSH'd) non-privileged users to mount arbitrary filesystems via udisks2 due to the used polkit rules. This includes filesystems whose mounting normally requires CAP_SYS_ADMIN in the init user namespace.

The article thoroughly describes a variety of techniques used in the exploit, including a cross-cache attack, page_alloc-level memory shaping, arbitrary write via red-black trees, and modprobe_path privilege escalation.

Linux kernel Rust module for rootkit detection

Article by Antoine Doglioli about implementing an in-kernel detector for many existing rootkits. The detector is written in Rust.

Three bypasses of Ubuntu's unprivileged user namespace restrictions

Article about bypassing the recent Ubuntu's restriction on getting capabilities in unprivileged user namespaces.

Kernel-Hack-Drill: Environment For Developing Linux Kernel Exploits

Alexander Popov (me) published the slides from his talk at Zer0Con 2025. In this talk, he presented the kernel-hack-drill open-source project and showed how it helped him to exploit CVE-2024-50264 in the Linux kernel.

Exploiting CVE-2024-0582 via the Dirty Pagetable Method

Kuzey Arda Bulut posted an article about exploiting CVE-2024-0582 in io_uring using the Dirty Pagetable technique.

This bug was previously reported by Jann Horn and exploited by Oriol Castejón.

CVE-2025-21756: Attack of the Vsock

Michael Hoefler published an article about exploiting an incorrect reference counter decrement causing a UAF in the vsock subsystem.

With advice from h0mbre, the researcher used brute force to bypass KASLR and hijacked the control flow for LPE.

RISC-V support in kernel-hardening-checker

Alexander Popov (me) added RISC-V support to kernel-hardening-checker. Now, you can check the Linux kernel security parameters for RISC-V in addition to X86_64, ARM64, X86_32, and ARM.

Linux Kernel Exploitation series

Awesome series of articles by r1ru that outlines many commonly-used modern exploitation techniques.

Comes with the reference exploit code.

A Quick Dive Into The Linux Kernel Page Allocator

Article by D3vil that explains the internals of the Page allocator.

[CVE-2025-37752] Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds

Great article by D3vil about exploiting a type confusion in the network scheduler subsystem and pwning all kernelCTF instances.

Author exploited a severely-limited OOB side-effect of the bug to corrupt pipe_inode_info->tmp_page and gain a page UAF read/write primitive. Researcher then swapped the private_data and f_cred fields of a signalfd file structure and overwrote the credentials via signalfd_ctx.