Bypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL

Xuan Xing & Eugene Rodionov gave a talk (slides) about fuzzing the Linux kernel interfaces fully in user space using LKL (Linux Kernel Library).

Linux Kernel Hardening: Ten Years Deep

Talk (slides) by Kees Cook about the relevance of various Linux kernel vulnerability classes and the mitigations that address them.

Fuzzing Linux Kernel Modules, with Slava Moskvin

Stream by Slava Moskvin hosted by Stephen Sims about building a custom fuzzer to rediscover CVE-2025-0927 in the HFS+ filesystem implementation.

Slava started with a simple fuzzer implementation and then improved it step-by-step by adding coverage collection, proper seed generation, mutations, etc.

The source code of the fuzzer is public.

CVE-2023-52927 - Turning a Forgotten Syzkaller Report into kCTF Exploit

Article by Hoàng Hải Long about finding an unfixed netfilter use-after-free bug reported by syzbot. The researcher exploited it to pwn the kernelCTF COS instance.

Debugging the Pixel 8 kernel via KGDB

Article by Andrey Konovalov about setting up KGDB on Pixel 8 for debugging its kernel.

Provides instructions for getting the kernel log over UART via USB-Cereal, building and flashing a kernel with KGDB, breaking into KGDB via /proc/sysrq-trigger or by sending SysRq-G over a serial connection, dealing with watchdogs, etc.

Exploiting All Google kernelCTF Instances And Debian 12 With A 0-Day For $82k: A RBTree Family Drama

Crusaders of Rust posted an article about exploiting a UAF in the network packet scheduler. The researchers manipulated red-black trees in the kernel to achieve a page-level UAF, which they used to escalate privileges.

From Chrome renderer code exec to kernel with MSG_OOB

Jann Horn posted an article about exploiting CVE-2025-38236, a UAF in the UNIX domain sockets. The article contains many interesting notes and takeaways on writing kernel exploits that work from within the Chrome renderer sandbox.

arm64: Linear mapping is mapped at the same static virtual address

Bug report by Seth Jenkins and Jann Horn showing that the physmap region is mapped at a fixed virtual address on Android despite KASLR.

ksmbd - Fuzzing Improvements and Vulnerability Discovery

Another article by Norbert Szetei about fuzzing the ksmbd module with syzkaller.

Covers the improvements made to the fuzzer since the previous article. These improvements allowed finding an impressive amount of 23 bugs in ksmbd.

corCTF 2025 - corphone

Article by Pumpkin about exploiting a UAF in a custom Android kernel module created for a CTF task.

The exploit gains control over the page tables and overwrites the kernel code to bypass SELinux and escalate privileges.

A Syzkaller Summer: Fixing False Positive Soft Lockups in net/sched Fuzzing

Article by Will's Root about fixing the soft lockup bug found when fuzzing the network scheduler subsystem with syzkaller.

The article also gives a summary about the exploitable bugs the author managed to find in the same subsystem.

The anatomy of a bug: 6 Months at STAR Labs

Gerrard Tai posted an article describing their experience in finding kernel bugs and participating in the KernelCTF and Pwn2Own competitions.

Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days

William Liu posted an article about exploiting a slab object overflow (CVE-2023-52440) and remote infoleak (CVE-2023-4130) in the kernel SMB3 daemon to gain RCE.

Dirty Pageflags: Revisiting PTE Exploitation in Linux

Article by ptr-yudai on the exploitation technique of overwriting the R/W flag in a PTE entry to allow writing into read-only files.

ksmbd - Exploiting CVE-2025-37947

Article by Norbert Szetei about locally exploiting CVE-2025-37947 — a page OOB write in the ksmbd module.

Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers

Article by Robin Bastide about exploiting a NULL-pointer-dereference that led to a UAF access to the kernel stack in the NVIDIA GPU driver.

The article shows an interesting scenario of how a NULL-pointer-dereference can lead to a more severe memory corruption. It also demonstrates a few techniques of shaping vmalloc memory for exploitation.

Defeating KASLR by Doing Nothing at All

Article by Seth Jenkins about a few problems with physical memory KASLR on arm64 devices.