Linux Kernel Security
Open in Telegram
Links related to Linux kernel security and exploitation | Chat @linkersec_chat | @xairy @a13xp0p0v | Mirrors on https://xairy.io/linkersec
Show more4 721
Subscribers
+424 hours
+217 days
+5330 days
Data loading in progress...
Similar Channels
Tags Cloud
Incoming and Outgoing Mentions
---
---
---
---
---
---
Attracting Subscribers
September '26Sep '26
September '26
+108
in 1 channels
August '26
+138
in 1 channels
Get PRO
July '26
+171
in 5 channels
Get PRO
June '26
+163
in 0 channels
Get PRO
May '26
+124
in 0 channels
Get PRO
April '26
+106
in 0 channels
Get PRO
March '26
+81
in 0 channels
Get PRO
February '26
+107
in 1 channels
Get PRO
January '26
+124
in 4 channels
Get PRO
December '25
+156
in 2 channels
Get PRO
November '25
+120
in 1 channels
Get PRO
October '25
+95
in 1 channels
Get PRO
September '25
+102
in 2 channels
Get PRO
August '25
+52
in 1 channels
Get PRO
July '25
+70
in 1 channels
Get PRO
June '25
+51
in 1 channels
Get PRO
May '25
+65
in 2 channels
Get PRO
April '25
+78
in 2 channels
Get PRO
March '25
+111
in 2 channels
Get PRO
February '25
+53
in 0 channels
Get PRO
January '25
+52
in 1 channels
Get PRO
December '24
+147
in 3 channels
Get PRO
November '24
+93
in 0 channels
Get PRO
October '24
+137
in 2 channels
Get PRO
September '24
+134
in 2 channels
Get PRO
August '24
+111
in 2 channels
Get PRO
July '24
+106
in 2 channels
Get PRO
June '24
+127
in 0 channels
Get PRO
May '24
+77
in 0 channels
Get PRO
April '24
+94
in 0 channels
Get PRO
March '24
+81
in 1 channels
Get PRO
February '24
+96
in 0 channels
Get PRO
January '24
+104
in 0 channels
Get PRO
December '23
+84
in 0 channels
Get PRO
November '23
+150
in 0 channels
Get PRO
October '23
+91
in 0 channels
Get PRO
September '23
+134
in 0 channels
Get PRO
August '23
+92
in 0 channels
Get PRO
July '23
+73
in 0 channels
Get PRO
June '23
+100
in 0 channels
Get PRO
May '23
+144
in 0 channels
Get PRO
April '23
+36
in 0 channels
Get PRO
March '23
+43
in 0 channels
Get PRO
February '23
+73
in 0 channels
Get PRO
January '23
+67
in 0 channels
Get PRO
December '22
+80
in 0 channels
Get PRO
November '22
+85
in 0 channels
Get PRO
October '22
+66
in 0 channels
Get PRO
September '22
+77
in 0 channels
Get PRO
August '22
+109
in 0 channels
Get PRO
July '22
+67
in 0 channels
Get PRO
June '22
+84
in 0 channels
Get PRO
May '22
+142
in 0 channels
Get PRO
April '22
+91
in 0 channels
Get PRO
March '22
+98
in 0 channels
Get PRO
February '22
+68
in 0 channels
Get PRO
January '22
+128
in 0 channels
Get PRO
December '21
+57
in 0 channels
Get PRO
November '21
+149
in 0 channels
Get PRO
October '21
+64
in 0 channels
Get PRO
September '21
+111
in 0 channels
Get PRO
August '21
+123
in 0 channels
Get PRO
July '21
+48
in 0 channels
Get PRO
June '21
+23
in 0 channels
Get PRO
May '21
+29
in 0 channels
Get PRO
April '21
+333
in 0 channels
| Date | Subscriber Growth | Mentions | Channels | |
| 28 September | 0 | |||
| 27 September | +4 | |||
| 26 September | 0 | |||
| 25 September | +4 | |||
| 24 September | +14 | |||
| 23 September | +4 | |||
| 22 September | +5 | |||
| 21 September | +2 | |||
| 20 September | +3 | |||
| 19 September | +1 | |||
| 18 September | +2 | |||
| 17 September | 0 | |||
| 16 September | +4 | |||
| 15 September | +10 | |||
| 14 September | +3 | |||
| 13 September | +3 | |||
| 12 September | +7 | |||
| 11 September | +4 | |||
| 10 September | 0 | |||
| 09 September | +1 | |||
| 08 September | +5 | |||
| 07 September | +5 | |||
| 06 September | +5 | |||
| 05 September | +2 | |||
| 04 September | +2 | |||
| 03 September | +9 | |||
| 02 September | +4 | |||
| 01 September | +5 |
Channel Posts
CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel
Paper by Dong-ok Kim, Juhyun Song, et al. documenting the steps for executing a cross-cache attacks for caches with min_partial >= cpu_partial_slabs.
The paper also describes a fuzzing-based approach of finding target slab objects useful for exploitation.
| 2 |  Testing race conditions with memory access tracing and stack-based delay injection
Article by Jann Horn about MAccConc β a KCOV-based tool for exploring possible kernel code interleavings of a multi-threaded program. | 1 992 |
| 3 |  SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free
Article about exploiting CVE-2026-64564 in the implementation of the Stream Control Transmission Protocol (SCTP). Authors exploited a UAF in the kmalloc-1k cache to gain root and escape a container. | 2 629 |
| 4 |  Gone in 60 Frames β USB Video Exploitation
Article (and slides) by Alex Plaskett and Robert Herrera about fuzzing USB drivers with syzkaller and writing an exploit that gains code execution over USB on Ubuntu. | 3 831 |
| 5 |  IonStack part III: Rooting Android 17 with GhostLock
Article about adapting the exploit of CVE-2026-43499 (racy stack use-after-free in the futex implementation) to Android.
The researchers used KernelSnitch, ashmem fops overwriting, pipe_buffer corruption, and other tricks to perform LPE. | 2 755 |
| 6 |  I handed the epoll UAF to an agent
Article by Guy Beck about using Claude for porting an exploit for an eventpoll vulnerability to Android. | 2 741 |
| 7 |  IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years
Article about exploiting a racy stack use-after-free in the futex implementation. The bug was used to pwn a kernelCTF instance. | 2 574 |
| 8 |  Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694)
Article by Stan Shaw about exploiting a page OOB write bug in the FUSE subsystem by overwriting /etc/passwd in the page cache. | 2 341 |
| 9 |  Januscape: Guest-to-Host Escape in KVM/x86
Hyunwoo Kim published an article about a use-after-free vulnerability in the shadow MMU emulation of KVM/x86 (CVE-2026-53359). Both Intel (VMX) and AMD (SVM) code is affected.
The article only covers achieving a kernel crash via this bug, but the vulnerability can also be exploited to escape the guest VM. The author used this bug to pwn a kvmCTF instance. | 2 441 |
| 10 |  ITScape: Guest-to-Host Escape in KVM/arm64
Article by Hyunwoo Kim about exploiting a race condition bug in the KVM driver on the arm64 architecture to escape the guest VM. | 7 309 |
| 11 |  Bad Epoll: The bug missed by Mythos
Article by Jaeyoung Chung about exploiting CVE-2026-46242 β a race condition bug in the eventpoll subsystem. Jaeyoung exploited this bug to claim a kernelCTF entry, but the vulnerability also affects Android kernels. | 4 335 |
| 12 |  Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215)
Stan Shaw published an article about exploiting UAF in a DRM GEM ioctl. The researcher reallocated freed memory as a pipe_buffer array to set PIPE_BUF_FLAG_CAN_MERGE and perform the Dirty Pipe attack. | 3 085 |
| 13 | Off By !: Exploiting a Use-after-Free in the Linux Kernel
Oliver Sieber published a write-up about CVE-2026-23111 in nftables, which they found in early 2025 and other researchers patched upstream in February 2026. The article describes exploiting this UAF on Debian and Ubuntu. | 2 785 |
| 14 | CIFSwitch: a non-universal Linux local root vulnerability
Asim Viladi Oglu Manizada posted an article about a nice logic bug in the interaction between the kernel CIFS subsystem and the userspace cifs-utils package.
An attacker can forge a "cifs.spnego" key in Linux keyring to make the kernel run a root userspace helper to escalate privileges of the attacker's process. | 2 656 |
| 15 |  Unix GC Remastered
Article by Moe Acherir about the internals of the new Unix sockets garbage collector implementation and the analysis of CVE-2025-40214, which was used in a kernelCTF entry. | 2 820 |
| 16 | PinTheft Linux LPE
Aaron Esau published an LPE exploit for a page double-free bug in the RDS zerocopy implementation, which can be turned into a page-cache overwrite through io_uring. | 2 461 |
| 17 |  Logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333)
Article about a logical bug in the ptrace implementation that allows getting access to file descriptors of other processes and thus escalating privileges in certain scenarios. | 2 923 |
| 18 |  StepStone: LLM-Based GPU Kernel Driver Fuzzing via User-Space Libraries
Paper by Xiaochen Zou et. al about using LLMs for generating syzkaller descriptions for fuzzing GPU drivers via their userspace libraries APIs. | 2 629 |
| 19 |  Privilege Escalation via a Page Use-After-Free in Qualcomm's AI Accelerator Linux Kernel Driver
Article by Lukas Maar about exploiting a bug in the mmap handler of the QAIC driver that causes a page UAF. | 2 575 |
| 20 |  Discovery & Validation in the Linux Kernel
Three-part article by Samuel Page about analyzing two vulnerabilities (in CAN sockets and FUSE) and attempting to use local LLMs to rediscover the bugs. | 2 849 |
