arm64: Linear mapping is mapped at the same static virtual address

Bug report by Seth Jenkins and Jann Horn showing that the physmap region is mapped at a fixed virtual address on Android despite KASLR.

ksmbd - Fuzzing Improvements and Vulnerability Discovery

Another article by Norbert Szetei about fuzzing the ksmbd module with syzkaller.

Covers the improvements made to the fuzzer since the previous article. These improvements allowed finding an impressive amount of 23 bugs in ksmbd.

corCTF 2025 - corphone

Article by Pumpkin about exploiting a UAF in a custom Android kernel module created for a CTF task.

The exploit gains control over the page tables and overwrites the kernel code to bypass SELinux and escalate privileges.

A Syzkaller Summer: Fixing False Positive Soft Lockups in net/sched Fuzzing

Article by Will's Root about fixing the soft lockup bug found when fuzzing the network scheduler subsystem with syzkaller.

The article also gives a summary about the exploitable bugs the author managed to find in the same subsystem.

The anatomy of a bug: 6 Months at STAR Labs

Gerrard Tai posted an article describing their experience in finding kernel bugs and participating in the KernelCTF and Pwn2Own competitions.

Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days

William Liu posted an article about exploiting a slab object overflow (CVE-2023-52440) and remote infoleak (CVE-2023-4130) in the kernel SMB3 daemon to gain RCE.

Dirty Pageflags: Revisiting PTE Exploitation in Linux

Article by ptr-yudai on the exploitation technique of overwriting the R/W flag in a PTE entry to allow writing into read-only files.

ksmbd - Exploiting CVE-2025-37947

Article by Norbert Szetei about locally exploiting CVE-2025-37947 — a page OOB write in the ksmbd module.

Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers

Article by Robin Bastide about exploiting a NULL-pointer-dereference that led to a UAF access to the kernel stack in the NVIDIA GPU driver.

The article shows an interesting scenario of how a NULL-pointer-dereference can lead to a more severe memory corruption. It also demonstrates a few techniques of shaping vmalloc memory for exploitation.

Defeating KASLR by Doing Nothing at All

Article by Seth Jenkins about a few problems with physical memory KASLR on arm64 devices.

kernelCTF: CVE-2025-38477

kernelCTF entry for a race condition in the network scheduler subsystem.

Most notably, shows a technique of putting controlled data into unmapped sections of vmlinux.

LPE via refcount imbalance in the af_unix of Ubuntu

Article and exploit by kylebot for a refcount imbalance bug in the Ubuntu kernel's Unix sockets implementation disclosed during the TyphoonPWN 2025 competition.

Exploiting CVE-2025-21479 on a Samsung S23

Article by XploitBengineer about exploiting a logical bug in the Qualcomm Adreno GPU firmware to take over the kernel on Samsung S23 via a combination of page table attacks.

Cracking the Pixel 8: Exploiting the Undocumented DSP to Bypass MTE

Talk (slides) by Pan Zhenpeng and Jheng Bing Jhong about exploiting a logical bug in the Pixel GXP driver that allows overwriting read-only files.

Enhancing FineIBT

LWN article that describes the talk by Scott Constable and Sebastian Österlund about the ongoing work to improve FineIBT (Fine-grain Control-flow Enforcement with Indirect Branch Tracking).

The article also refers to another post "A hole in FineIBT protection" about a method to bypass this CFI mechanism.

Slice: SAST + LLM Interprocedural Context Extractor

Amazing article by Caleb Gross about combining the use of CodeQL and LLMs to reliably rediscover CVE-2025-37899 — a remotely-triggerable vulnerability in the ksmbd module.

LinkPro: eBPF rootkit analysis

Théo Letailleur published an article with a detailed denoscription of an eBPF rootkit that hides itself on the compromised system and activates its features upon receiving a "magic packet".

Race Condition Symphony: From Tiny Idea to Pwnie

Slides from a talk by Hyunwoo Kim and Wongi Lee about exploiting CVE-2024-50264 — a race condition in the vsock subsystem.

Previously, Alexander Popov described another way to exploit this vulnerability.