@linkersec

Links related to Linux kernel security and exploitation. Maintained by @andreyknvl and @a13xp0p0v.

xairy.io/linkersec
Joined September 2021
  • Tweets439
  • Following0
  • Followers10.6K
139Media
SoK: Take a Deep Step into Linux Kernel Hardening Effectiveness from the Offensive-Defensive Perspective A paper with analysis of 121 publicly documented exploits since 2015 and in-depth evaluation of 51 existing kernel defense mechanisms. ndss-symposium.org/ndss-pape…
25
105
4,129
PageJack in Action: CVE-2022-0995 exploit Article by Jean Vincent describing how a relatively old CVE can be exploited using the PageJack exploitation technique. blog.quarkslab.com/pagejack-…
6
37
2,591
CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel Paper by Dong-ok Kim, Juhyun Song, et al. documenting the steps for executing a cross-cache attacks for caches with min_partial >= cpu_partial_slabs. insuyun.github.io/pubs/2025/…
1
9
55
3,157
The paper also describes a fuzzing-based approach of finding target slab objects useful for exploitation.
476
Testing race conditions with memory access tracing and stack-based delay injection Article by @tehjh about MAccConc — a KCOV-based tool for exploring possible kernel code interleavings of a multi-threaded program. Article: projectzero.google/2026/09/m… Tool: github.com/googleprojectzero…
2
36
2,130
SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free Article about exploiting CVE-2026-64564 in the Stream Control Transmission Protocol (SCTP) implementation. Authors exploited a UAF in the kmalloc-1k cache to gain root and escape a container matrix.tencent.com/en/2026/0…
10
37
3,020
Gone in 60 Frames – USB Video Exploitation Article (and slides) by @alexjplaskett and @robHerrera_ about fuzzing USB drivers with syzkaller and writing an exploit that gains code execution over USB on Ubuntu. Article: media.defcon.org/DEF%20CON%2… Slides: media.defcon.org/DEF%20CON%2…
2
19
174
6,346
IonStack part III: Rooting Android 17 with GhostLock Article about adapting the exploit of CVE-2026-43499 (kernel stack UAF) to Android. The researchers used KernelSnitch, ashmem fops overwriting, pipe_buffer corruption, and other tricks to perform LPE. nebusec.ai/research/ionstack…
25
116
5,157
I handed the epoll UAF to an agent Article by Guy Beck about using Claude for porting an exploit for an eventpoll vulnerability to Android. guysrd.github.io/epoll-uaf-a…
1
12
82
5,456
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years Article about exploiting a racy stack use-after-free in the futex implementation. The bug was used to pwn a kernelCTF instance. nebusec.ai/research/ionstack…
1
14
78
4,525
Januscape: Guest-to-Host Escape in KVM/x86 @v4bel published an article about a use-after-free vulnerability in the shadow MMU emulation of KVM/x86 (CVE-2026-53359). Both Intel (VMX) and AMD (SVM) code is affected. github.com/V4bel/Januscape/b…
1
8
27
3,101
The article only covers achieving a kernel crash via this bug, but the vulnerability can also be exploited to escape the guest VM. The author used this bug to pwn a kvmCTF instance.
1
705
ITScape: Guest-to-Host Escape in KVM/arm64 Article by @v4bel about exploiting a race condition bug in the KVM driver on the arm64 architecture to escape the guest VM. github.com/V4bel/ITScape
11
43
3,675
Bad Epoll: The bug missed by Mythos Article by Jaeyoung Chung about exploiting CVE-2026-46242 — a race condition bug in the eventpoll subsystem. Jaeyoung exploited this bug to claim a kernelCTF entry, but the vulnerability also affects Android kernels. github.com/J-jaeyoung/bad-ep…
3
14
2
111
7,533
Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215) Stan Shaw published an article about exploiting UAF in a DRM GEM ioctl. The researcher reallocated freed memory as a pipe_buffer array to perform the Dirty Pipe attack. cyberstan.co.uk/drm-lpe-linu…
15
89
4,713
Off By !: Exploiting a Use-after-Free in the Linux Kernel Oliver Sieber published write-up on CVE-2026-23111 in nftables, found in early 2025, patched upstream by other researchers in Feb 2026. Article describes exploiting this UAF on Debian and Ubuntu. blog.exodusintel.com/2026/06…

Off By !: Exploiting a Use-after-Free in the Linux Kernel - Exodus Intelligence

By Oliver Sieber Overview In this blog post, we discuss a use-after-free vulnerability that we found in the nftables subsystem of the Linux kernel in early 2025. This vulnerability was patched...

blog.exodusintel.com
14
77
4,707
CIFSwitch: a non-universal Linux local root vulnerability Asim Viladi Oglu Manizada posted an article about a nice logic bug in the interaction between the kernel CIFS subsystem and the userspace cifs-utils package. heyitsas.im/posts/cifswitch/

CIFSwitch: a non-universal Linux local root vulnerability

Harnessing LLMs into composing complex, multihop vulnerability chains to discover CVE-2026-46243

heyitsas.im
1
4
14
2,250
An attacker can forge a "cifs.spnego" key in Linux keyring to make the kernel run a root userspace helper to escalate privileges of the attacker's process.
1
2
1,009
Unix GC Remastered Article by @AcherirMoe about the internals of the new Unix sockets garbage collector implementation and the analysis of CVE-2025-40214, which was used in a kernelCTF entry. mohandacherir.github.io/Qdiv…
9
43
2,835
PinTheft Linux LPE Aaron Esau published an LPE exploit for a page double-free bug in the RDS zerocopy implementation, which can be turned into a page-cache overwrite through io_uring github.com/v12-security/pocs…
6
35
2,477
Load more