en
Feedback
Linux Kernel Security

Linux Kernel Security

Open in Telegram

Links related to Linux kernel security and exploitation | Chat @linkersec_chat | @xairy @a13xp0p0v | Mirrors on https://xairy.io/linkersec

Show more
Russia115 956Technologies & Applications19 078
4 680
Subscribers
+424 hours
+217 days
+6930 days

Data loading in progress...

Similar Channels
The Bug Bounty Hunter
50.2K
The Bug Bounty Hunter
r0 Crew (Channel)
9.2K
r0 Crew (Channel)
PT SWARM
6.8K
PT SWARM
idapro (Not official)
2.7K
idapro (Not official)
CloudSec Wine
2.3K
CloudSec Wine
avatar
1
More channels
Tags Cloud
kernel65
linux26
exploit20
driver19
cve-202518
exploitation11
subsystem11
gpu10
module9
slide9
uaf9
author8
cve-20248
ksmbd8
privilege8
implementation7
researcher7
rootkit7
context6
scheduler6
Incoming and Outgoing Mentions
---
---
---
---
---
---
Attracting Subscribers
August '26
August '26
+137
in 1 channels
July '26
+171
in 5 channels
Get PRO
June '26
+163
in 0 channels
Get PRO
May '26
+124
in 0 channels
Get PRO
April '26
+106
in 0 channels
Get PRO
March '26
+81
in 0 channels
Get PRO
February '26
+107
in 1 channels
Get PRO
January '26
+124
in 4 channels
Get PRO
December '25
+156
in 2 channels
Get PRO
November '25
+120
in 1 channels
Get PRO
October '25
+95
in 1 channels
Get PRO
September '25
+102
in 2 channels
Get PRO
August '25
+52
in 1 channels
Get PRO
July '25
+70
in 1 channels
Get PRO
June '25
+51
in 1 channels
Get PRO
May '25
+65
in 2 channels
Get PRO
April '25
+78
in 2 channels
Get PRO
March '25
+111
in 2 channels
Get PRO
February '25
+53
in 0 channels
Get PRO
January '25
+52
in 1 channels
Get PRO
December '24
+147
in 3 channels
Get PRO
November '24
+93
in 0 channels
Get PRO
October '24
+137
in 2 channels
Get PRO
September '24
+134
in 2 channels
Get PRO
August '24
+111
in 2 channels
Get PRO
July '24
+106
in 2 channels
Get PRO
June '24
+127
in 0 channels
Get PRO
May '24
+77
in 0 channels
Get PRO
April '24
+94
in 0 channels
Get PRO
March '24
+81
in 1 channels
Get PRO
February '24
+96
in 0 channels
Get PRO
January '24
+104
in 0 channels
Get PRO
December '23
+84
in 0 channels
Get PRO
November '23
+150
in 0 channels
Get PRO
October '23
+91
in 0 channels
Get PRO
September '23
+134
in 0 channels
Get PRO
August '23
+92
in 0 channels
Get PRO
July '23
+73
in 0 channels
Get PRO
June '23
+100
in 0 channels
Get PRO
May '23
+144
in 0 channels
Get PRO
April '23
+36
in 0 channels
Get PRO
March '23
+43
in 0 channels
Get PRO
February '23
+73
in 0 channels
Get PRO
January '23
+67
in 0 channels
Get PRO
December '22
+80
in 0 channels
Get PRO
November '22
+85
in 0 channels
Get PRO
October '22
+66
in 0 channels
Get PRO
September '22
+77
in 0 channels
Get PRO
August '22
+109
in 0 channels
Get PRO
July '22
+67
in 0 channels
Get PRO
June '22
+84
in 0 channels
Get PRO
May '22
+142
in 0 channels
Get PRO
April '22
+91
in 0 channels
Get PRO
March '22
+98
in 0 channels
Get PRO
February '22
+68
in 0 channels
Get PRO
January '22
+128
in 0 channels
Get PRO
December '21
+57
in 0 channels
Get PRO
November '21
+149
in 0 channels
Get PRO
October '21
+64
in 0 channels
Get PRO
September '21
+111
in 0 channels
Get PRO
August '21
+123
in 0 channels
Get PRO
July '21
+48
in 0 channels
Get PRO
June '21
+23
in 0 channels
Get PRO
May '21
+29
in 0 channels
Get PRO
April '21
+333
in 0 channels
Date
Subscriber Growth
Mentions
Channels
31 August+7
30 August+4
29 August+3
28 August+5
27 August+3
26 August+4
25 August+5
24 August+4
23 August+3
22 August+4
21 August+3
20 August+5
19 August+5
18 August0
17 August+7
16 August+3
15 August+3
14 August+4
13 August+4
12 August+7
11 August+8
10 August+7
09 August+10
08 August+4
07 August+4
06 August0
05 August+1
04 August+5
03 August+7
02 August+7
01 August+1
Channel Posts
Linux Kernel Security
Gone in 60 Frames ā€“ USB Video Exploitation Article (and slides) by Alex Plaskett and Robert Herrera about fuzzing USB drivers
Gone in 60 Frames ā€“ USB Video Exploitation Article (and slides) by Alex Plaskett and Robert Herrera about fuzzing USB drivers with syzkaller and writing an exploit that gains code execution over USB on Ubuntu.

2
IonStack part III: Rooting Android 17 with GhostLock Article about adapting the exploit of CVE-2026-43499 (racy stack use-aft
IonStack part III: Rooting Android 17 with GhostLock Article about adapting the exploit of CVE-2026-43499 (racy stack use-after-free in the futex implementation) to Android. The researchers used KernelSnitch, ashmem fops overwriting, pipe_buffer corruption, and other tricks to perform LPE.
2 171
3
I handed the epoll UAF to an agent Article by Guy Beck about using Claude for porting an exploit for an eventpoll vulnerabili
I handed the epoll UAF to an agent Article by Guy Beck about using Claude for porting an exploit for an eventpoll vulnerability to Android.
2 760
4
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years Article about exploiting a
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years Article about exploiting a racy stack use-after-free in the futex implementation. The bug was used to pwn a kernelCTF instance.
2 574
5
Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694) Article by Stan Shaw about exploiting
Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694) Article by Stan Shaw about exploiting a page OOB write bug in the FUSE subsystem by overwriting /etc/passwd in the page cache.
2 341
6
Januscape: Guest-to-Host Escape in KVM/x86 Hyunwoo Kim published an article about a use-after-free vulnerability in the shado
Januscape: Guest-to-Host Escape in KVM/x86 Hyunwoo Kim published an article about a use-after-free vulnerability in the shadow MMU emulation of KVM/x86 (CVE-2026-53359). Both Intel (VMX) and AMD (SVM) code is affected. The article only covers achieving a kernel crash via this bug, but the vulnerability can also be exploited to escape the guest VM. The author used this bug to pwn a kvmCTF instance.
2 441
7
ITScape: Guest-to-Host Escape in KVM/arm64 Article by Hyunwoo Kim about exploiting a race condition bug in the KVM driver on
ITScape: Guest-to-Host Escape in KVM/arm64 Article by Hyunwoo Kim about exploiting a race condition bug in the KVM driver on the arm64 architecture to escape the guest VM.
7 327
8
Bad Epoll: The bug missed by Mythos Article by Jaeyoung Chung about exploiting CVE-2026-46242 ā€” a race condition bug in the e
Bad Epoll: The bug missed by Mythos Article by Jaeyoung Chung about exploiting CVE-2026-46242 ā€” a race condition bug in the eventpoll subsystem. Jaeyoung exploited this bug to claim a kernelCTF entry, but the vulnerability also affects Android kernels.
4 335
9
Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215) Stan Shaw published an article about exploit
Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215) Stan Shaw published an article about exploiting UAF in a DRM GEM ioctl. The researcher reallocated freed memory as a pipe_buffer array to set PIPE_BUF_FLAG_CAN_MERGE and perform the Dirty Pipe attack.
3 085
10
Off By !: Exploiting a Use-after-Free in the Linux Kernel Oliver Sieber published a write-up about CVE-2026-23111 in nftables, which they found in early 2025 and other researchers patched upstream in February 2026. The article describes exploiting this UAF on Debian and Ubuntu.
2 785
11
CIFSwitch: a non-universal Linux local root vulnerability Asim Viladi Oglu Manizada posted an article about a nice logic bug in the interaction between the kernel CIFS subsystem and the userspace cifs-utils package. An attacker can forge a "cifs.spnego" key in Linux keyring to make the kernel run a root userspace helper to escalate privileges of the attacker's process.
2 656
12
Unix GC Remastered Article by Moe Acherir about the internals of the new Unix sockets garbage collector implementation and th
Unix GC Remastered Article by Moe Acherir about the internals of the new Unix sockets garbage collector implementation and the analysis of CVE-2025-40214, which was used in a kernelCTF entry.
2 820
13
PinTheft Linux LPE Aaron Esau published an LPE exploit for a page double-free bug in the RDS zerocopy implementation, which can be turned into a page-cache overwrite through io_uring.
2 461
14
Logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333) Article about a logical bug in the ptrace imp
Logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333) Article about a logical bug in the ptrace implementation that allows getting access to file descriptors of other processes and thus escalating privileges in certain scenarios.
2 923
15
StepStone: LLM-Based GPU Kernel Driver Fuzzing via User-Space Libraries Paper by Xiaochen Zou et. al about using LLMs for gen
StepStone: LLM-Based GPU Kernel Driver Fuzzing via User-Space Libraries Paper by Xiaochen Zou et. al about using LLMs for generating syzkaller descriptions for fuzzing GPU drivers via their userspace libraries APIs.
2 629
16
Privilege Escalation via a Page Use-After-Free in Qualcomm's AI Accelerator Linux Kernel Driver Article by Lukas Maar about e
Privilege Escalation via a Page Use-After-Free in Qualcomm's AI Accelerator Linux Kernel Driver Article by Lukas Maar about exploiting a bug in the mmap handler of the QAIC driver that causes a page UAF.
2 575
17
Discovery & Validation in the Linux Kernel Three-part article by Samuel Page about analyzing two vulnerabilities (in CAN sock
Discovery & Validation in the Linux Kernel Three-part article by Samuel Page about analyzing two vulnerabilities (in CAN sockets and FUSE) and attempting to use local LLMs to rediscover the bugs.
2 849
18
Recent Page Cache Corruption Bugs Multitude of vulnerabilities that allow overwriting the page cache and thus changing the in-memory contents of read-only files to gain LPE or escape a container in certain scenarios. All stem from kernel code paths that perform in-place overwrites of user-supplied input pages without verifying that the pages are writable. Copy Fail (CVE-2026-31431): ā€” Announcement; ā€” Better write-up. Dirty Frag (CVE-2026-43284 and CVE-2026-43500): ā€” Covers two independent vulnerabilities that do not require chaining; ā€” CVE-2026-43284 is alternatively titled Copy Fail 2; ā€” Original write-up; ā€” Avoiding bruteforcing for CVE-2026-43500. Fragnesia (CVE-2026-46300): ā€” Original report; ā€” Variant. DirtyCBC / DirtyDecrypt (CVE-2026-31635?): ā€” Write-up; ā€” Another exploit.
2 903
19
+1
No text...
1 998
20
Some notes on the security properties of the pipe_buffer kernel object a13xp0p0v (me) posted an article about a few experiments with the pipe_buffer kernel object within his kernel-hack-drill project. Alexander described multiple pipe_buffer features relevant for kernel exploits that rely on this object.
2 545
View all posts