iiinova — where your digital self keeps evolving

Linux Kernel Security @linkersec.bsky.social · 10/06/2026

Unix GC Remastered Article by Moe Acherir about the internals of the new Unix sockets garbage collector implementation and the analysis of CVE-2025-40214, which was used in a kernelCTF entry. mohandacherir.github.io/Qdiv7/posts/...

000

Linux Kernel Security @linkersec.bsky.social · 09/06/2026

PinTheft Linux LPE Aaron Esau published an LPE exploit for a page double-free bug in the RDS zerocopy implementation, which can be turned into a page-cache overwrite through io_uring. github.com/v12-security...

github.com

pocs/pintheft at main · v12-security/pocs

poc it like it's hot. Contribute to v12-security/pocs development by creating an account on GitHub.

Linux Kernel Security @linkersec.bsky.social · 03/06/2026

Logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333) Article about a logical bug in the ptrace implementation that allows getting access to file descriptors of other processes and thus escalating privileges in certain scenarios. cdn2.qualys.com/advisory/202...

Linux Kernel Security @linkersec.bsky.social · 01/06/2026

StepStone: LLM-Based GPU Kernel Driver Fuzzing via User-Space Libraries Paper by Xiaochen Zou et. al about using LLMs for generating syzkaller descriptions for fuzzing GPU drivers via their userspace libraries APIs. www.cs.ucr.edu/%7Ezhiyunq/p...

000

Linux Kernel Security @linkersec.bsky.social · 29/05/2026

Privilege Escalation via a Page Use-After-Free in Qualcomm's AI Accelerator Linux Kernel Driver Article by Lukas Maar about exploiting a bug in the mmap handler of the QAIC driver that causes a page UAF. lukasmaar.github.io/posts/qaic-p...

Linux Kernel Security @linkersec.bsky.social · 22/05/2026

Discovery & Validation in the Linux Kernel Three-part article by @sam4k.com about analyzing two vulnerabilities (in CAN sockets and FUSE) and attempting to use local LLMs to rediscover the bugs. Final part: bynar.io/blog/discove...

020

Linux Kernel Security @linkersec.bsky.social · 20/05/2026

Recent Page Cache Corruption Bugs All stem from code paths that allow in-place overwrites of user-supplied input pages without verifying they are writable. This enables overwriting page cache and thus changing in-memory contents of read-only files. Selected links below ⬇️

122

Linux Kernel Security @linkersec.bsky.social · 28/04/2026

Some notes on the security properties of the pipe_buffer kernel object Alexander Popov posted an article about a few experiments with the pipe_buffer kernel object within his kernel-hack-drill project. a13xp0p0v.github.io/2026/04/20/p...

a13xp0p0v.github.io

Some notes on the security properties of the pipe_buffer kernel object

Many exploits of Linux kernel vulnerabilities use the pipe_buffer kernel object to build strong exploit primitives. When I was experimenting with my personal project kernel-hack-drill, I discovered so...

100

Linux Kernel Security @linkersec.bsky.social · 23/04/2026

Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs Hyunwoo Kim published an article describing a complicated exploit of a race condition caused by a misuse of the cancel_work_sync() kernel API in the network subsystem. v4bel.github.io/linux/2026/0...

000

Linux Kernel Security @linkersec.bsky.social · 17/04/2026

Walkthrough of an N-day Android GPU driver vulnerability Talk by Angus about analyzing CVE-2022-22706 — a logical bug in the Mali GPU driver that allows getting write access to read-only memory. www.youtube.com/watch?v=G71d...

Walkthrough of an N-day Android GPU driver vulnerability - Angus, BSides Canberra 2025

YouTube video by BSides Canberra

000

Linux Kernel Security @linkersec.bsky.social · 16/04/2026

From KernelSnitch to Practical msg_msg/pipe_buffer Heap KASLR Leaks Article by Lukas Maar about evaluating the KernelSnitch timing side-channel attack on a variety of systems, including Android. lukasmaar.github.io/posts/heap-k...

112

Linux Kernel Security @linkersec.bsky.social · 14/04/2026

Assessing Claude Mythos Preview’s cybersecurity capabilities Article by Nicholas Carlini et. al about the security research capabilities of the new Anthropic's LLM called Claude Mythos Preview. red.anthropic.com/2026/mythos-...

100

Linux Kernel Security @linkersec.bsky.social · 13/04/2026

slab: support for compiler-assisted type-based slab cache partitioning Marco Elver posted a kernel patch that provides an alternative mode to RANDOM_KMALLOC_CACHES called TYPED_KMALLOC_CACHES. lore.kernel.org/all/20260331...

100

Linux Kernel Security @linkersec.bsky.social · 11/04/2026

CrackArmor: Multiple vulnerabilities in AppArmor Article about a variety of vulnerabilities found in the AppArmor LSM implementation, including a few kernel memory corruptions. Authors exploited them to achieve LPE on Ubuntu and Debian. cdn2.qualys.com/advisory/202...

Linux Kernel Security @linkersec.bsky.social · 17/03/2026

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets Excellent article by Quang Le about exploiting CVE-2025-38617 — a race condition that leads to a use-after-free in the packet sockets implementation. blog.calif.io/p/a-race-wit...

112

Linux Kernel Security @linkersec.bsky.social · 04/03/2026

Analysis of Linux kernel bug fixes Jenny Guanni Qu posted a detailed analysis: — Kernel bugs hide for 2 years on average. Some hide for 20. pebblebed.com/blog/kernel-... — Who Writes the Bugs? A Deeper Look at 125,000 Kernel Vulnerabilities pebblebed.com/blog/kernel-...

000

Linux Kernel Security @linkersec.bsky.social · 07/02/2026

setresuid(⚡): Glitching Google's TV Streamer from adb to root. Talk by Niek Timmers about glitching the kernel of the Android-based Google TV Streamer device to escalate privileges via Electromagnetic Fault Injection. Video: www.youtube.com/watch?v=-w5m... Slides: hardwear.io/netherlands-...

Hardwear.io NL 2025: Glitching Google's TV Streamer From Adb To Root - Niek Timmers

YouTube video by hardwear.io

Linux Kernel Security @linkersec.bsky.social · 05/02/2026

[Cryptodev-linux] Page-level UAF exploitation nasm_re posted an article about exploiting a page-level UAF in the out-of-tree cryptodev-linux driver. The researcher modified struct file sprayed into a freed page to escalate privileges. nasm.re/posts/crypto...

nasm.re

[Cryptodev-linux] Page-level UAF exploitation

IntroductionIn november 2025 I started a fuzzing campaign against cryptodev-linux as part of a school project. I found +10 bugs (UAF, NULL pointer dereferences and integer overflows) and among all of

031

Linux Kernel Security @linkersec.bsky.social · 03/02/2026

Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers Talk by Xingyu Jin & Martijn Bogaard about a new type of logical bugs in kernel driver mmap handlers exploitable via the ptrace functionality. Video: www.youtube.com/watch?v=yAUJ... Slides: powerofcommunity.net/2025/slide/x...

POC2025 | Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers

YouTube video by POC2026

Linux Kernel Security @linkersec.bsky.social · 28/01/2026

A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave Article by Seth Jenkins about exploiting a use-after-free in the driver for BigWave — an AV1 decoding hardware component present on Pixel SOCs. projectzero.google/2026/01/pixe...

Linux Kernel Security @linkersec.bsky.social · 19/01/2026

Article series about exploiting CVE-2025-38352 Faith posted three articles about exploiting a race condition in the implementation of POSIX CPU timers. Part 1️⃣ describes reproducing this race condition: faith2dxy.xyz/2025-12-22/c...

faith2dxy.xyz

CVE-2025-38352 (Part 1) - In-the-wild Android Kernel Vulnerability Analysis + PoC

Analyzing and writing a PoC for CVE-2025-38352.

100

Linux Kernel Security @linkersec.bsky.social · 05/01/2026

mediatek? more like media-rekt, amirite. Article by hypr covering an assortment of bugs the author found in the MediaTek MT76xx and MT7915 Wi-Fi drivers. blog.coffinsec.com/0days/2025/1...

blog.coffinsec.com

mediatek? more like media-REKT, amirite.

A year-in-review going over 19+ bugs in Mediatek’s MT76xx/MT7915 (and others) wifi chipsets I reported this year, PoCs included!

100

Linux Kernel Security @linkersec.bsky.social · 22/12/2025

CVE-2025-68260: rust_binder: fix race condition on death_list First CVE was registered for the new Binder kernel driver written in Rust. The vulnerability is a race condition caused by a list operation in an unsafe code block. lore.kernel.org/linux-cve-an...

000

Linux Kernel Security @linkersec.bsky.social · 18/12/2025

MatheuZSec published a detailed article about Singularity — a loadable kernel module rootkit developed for 6.x Linux kernels. The rootkit uses ftrace for hooking syscalls and hiding itself. Article: blog.kyntra.io/Singularity-... Code: github.com/MatheuZSecur...

blog.kyntra.io

Singularity: Deep Dive into a Modern Stealth Linux Kernel Rootkit – Kyntra Blog

Deep dive into a modern stealth Linux kernel rootkit with advanced evasion and persistence techniques

Linux Kernel Security @linkersec.bsky.social · 16/12/2025

Extending Kernel Race Windows Using '/dev/shm' Article by Faith about extending race condition windows via FALLOC_FL_PUNCH_HOLE. The technique allows delaying user memory accesses from the kernel mode, similar to userfaultfd and FUSE. faith2dxy.xyz/2025-11-28/e...

000

Linux Kernel Security @linkersec.bsky.social · 10/12/2025

An RbTree Family Drama Talk by William Liu and Savino Dicanosa @cor_ctf about exploiting CVE-2025-38001 — a use-after-free in the network packet scheduler. Video: www.youtube.com/watch?v=C-52... Slides: storage.googleapis.com/static.cor.t...

HEXACON 2025 - An RbTree Family Drama by William Liu & Savino Dicanosa

YouTube video by Hexacon

100

Linux Kernel Security @linkersec.bsky.social · 06/12/2025

Déjà Vu in Linux io_uring Talk by Pumpkin about exploiting CVE-2025-21836 — a race condition that leads to a use-after-free in the io_uring subsystem. Video: www.youtube.com/watch?v=Ry4e... Slides: u1f383.github.io/slides/talks...

HEXACON 2025 - Déjà Vu in Linux io_uring by Pumpkin

YouTube video by Hexacon

000

Linux Kernel Security @linkersec.bsky.social · 05/12/2025

CUDA de Grâce Talk by @chompie.rip and Samuel Lovejoy about exploiting a race condition that leads to a double-free in the NVIDIA GPU driver to escape a container created with NVIDIA Container Toolkit. Video: www.youtube.com/watch?v=Lvz2... Slides: docs.google.com/presentation...