xairy/linux-kernel-exploitation
A collection of links related to Linux kernel security and exploitation
A collection of links related to Linux kernel security and exploitation.
Updated bimonthly. Pull requests are welcome as well.
Follow @andreyknvl on X, @[email protected] on Mastodon, or @andreyknvl on Bluesky to be notified of updates.
Subscribe to @linkersec on Telegram, X, Mastodon, Bluesky, or Reddit for highlights.
See xairy.io/trainings/.
2014: "Android Hacker's Handbook" by Joshua J. Drake [book]
2012: "A Guide to Kernel Exploitation: Attacking the Core" by Enrico Perla and Massimiliano Oldani [book] [materials]
2026: "Kernel-Exploit-Dojo" [code]
2026: "Kernel-Hack-Drill Masterclass" by Alexander Popov [video]
2026: "PhantomMap: GPU-Assisted Kernel Exploitation" by Jiayi Hu et. al [paper] [slides] [video]
2026: "Some notes on the security properties of the pipe_buffer kernel object" by Alexander Popov [article]
2026: "Cross-Cache Attacks for the Linux Kernel via PCP Massaging" by Claudio Migliorelli et. al [paper]
2026: "Improving Linux Heap Exploit Reliability with FreshSlices and CPU-Bullying" [article]
2026: "DIRTYFREE: Simplified Data-Oriented Programming in the Linux Kernel" [paper]
2026: "Table Manners: Diving into Linux pagetables exp techniques" by Lau [slides]
2025: "CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel" by Dong-ok Kim et. al [paper]
2025: "Extending Kernel Race Windows Using '/dev/shm'" by Faith [article]
2025: "Linux Kernel Exploitation for Beginners" by Kevin Massey [slides] [video]
2025: "KernelGP: Racing Against the Android Kernel" by Chariton Karamitas [video]
2025: "Control Flow Hijacking in the Linux Kernel" by Valeriy Yashnikov [slides] [video]
2025: "Kernel Exploitation Techniques: Turning The (Page) Tables" by Samuel Page [article]
2025: "Linux Kernel Exploitation series" by r1ru [articles] [code]
2025: "Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch" [article]
2025: "WHEN GOOD KERNEL DEFENSES GO BAD: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks" by Lukas Maar et al. [paper] [artifacts] [github]
2025: "Cross Cache Attack CheetSheet" by Pumpkin Chang [article]
2024: "Cross Cache for Lazy People -- The Padding Spray Method" [article]
2024: "Linux Kernel Use Pipe Object to Do Data-Only Attack" by Pumpkin Chang [article]
2024: "CTF-style Tricks of Linux Kernel Exploitation" by Pumpkin Chang [article] [part 2]
2024: "Linux Kernel exploitation cheatsheet" by Pumpkin Chang [article]
2024: "SLUB Internals for Exploit Developers" by Andrey Konovalov [slides] [video]
2024: "PageJack: A Powerful Exploit Technique With Page-Level UAF" by Zhiyun Qian et. al [slides] [video] [code] [summary]
2024: "Linux Kernel Exploitation - ret2usr" by Sascha Schirra [article]
2024: "Binary Exploitation Notes: Kernel" by Andrej Ljubic [articles]
2024: "Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation" [paper]
2024: "GhostRace: Exploiting and Mitigating Speculative Race Conditions" [paper]
2024: "Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems" [paper]
2023: "Deep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernel" by Yudai Fujiwara [slides] [video]
2023: "No Tux Given: Diving Into Contemporary Linux Kernel Exploitation" by sam4k [slides]
2023: "Linux Kernel Exploitation series" by santaclz [article] [part2] [part 3]
2023: "RetSpill: Igniting User-Controlled Data to Burn Away Linux Kernel Protections" [paper]
2023: "Understanding Dirty Pagetable - m0leCon Finals 2023 CTF Writeup" [article]
2023: "Abusing RCU callbacks with a Use-After-Free read to defeat KASLR" [article]
2023: "Evils in the Sparse Texture Memory: Exploit Kernel Based on Undefined Behaviors of Graphic APIs" [slides] [abstract]
2023: "Make KSMA Great Again: The Art of Rooting Android devices by GPU MMU features" by Yong Wang [video] [slides]
2023: "A new method for container escape using file-based DirtyCred" by Choo Yi Kai [article]
2023: "prctl anon_vma_name: An Amusing Linux Kernel Heap Spray" by Cherie-Anne Lee [article]
2023: "Dirty Pagetable: A Novel Exploitation Technique To Rule Linux Kernel" by Nicolas Wu [article]
2023: "Exploit Engineering – Attacking the Linux Kernel" by Alex Plaskett and Cedric Halbronn [slides] [video]
2023: "Algorithmic Heap Layout Manipulation in the Linux Kernel" by Max Ufer and Daniel Baier [paper] [artifacts]
2023: "The Return of Stack Overflows in the Linux Kernel" by Davide Ornaghi [slides] [video]
2023: "Exploiting null-dereferences in the Linux kernel" by Seth Jenkins [article]
2023: "PSPRAY: Timing Side-Channel based Linux Kernel Heap Exploitation Technique" [paper] [video]
2023: "Linux Kernel PWN | 06 DirtyCred" [article]
2023: "Linux Kernel PWN | 05 ret2dir" [article]
2022: "Ret2page: The Art of Exploiting Use-After-Free Vulnerabilities in the Dedicated Cache" [slides] [video]
2022: "Devils Are in the File Descriptors: It Is Time To Catch Them All" by Le Wu [slides] [video]
2022: "FUSE for Linux Exploitation 101" [article]
2022: "Kernel Exploit Recipes" [brochure]
2022: "pipe_buffer arbitrary read write" by Jayden R [article]
2022: "Joy of exploiting the Kernel" [slides]
2022: "An exploit primitive in the Linux kernel inspired by DirtyPipe" [article]
2022: "DirtyCred: Escalating Privilege in Linux Kernel" [paper] [slides] [artifacts]
2022: "DirtyCred: Cautious! A New Exploitation Method! No Pipe but as Nasty as Dirty Pipe" [slides] [artifacts]
2022: "USMA: Share Kernel Code With Me" by Yong Liu, Jun Yao, and Xiaodong Wang [slides] [video] [paper] [article]
2022: "Linux kernel heap feng shui in 2022" by Michael S and Vitaly Nikolenko [article]
2022: "LiKE: A Series on Linux Kernel Exploitation" by sam4k [article] [modprobe_path]
2022: "Racing against the clock -- hitting a tiny kernel race window" by Jann Horn [article]
2022: "Playing for K(H)eaps: Understanding and Improving Linux Kernel Exploit Reliability" [paper] [artifacts]
2022: "Learning Linux kernel exploitation" by 0x434b [article] [part 2]
2021: "ExpRace: Exploiting Kernel Races through Raising Interrupts" at USENIX [paper] [slides] [video]
2021: "Utilizing msg_msg Objects for Arbitrary Read and Arbitrary Write in the Linux Kernel" [article] [part2]
2021: "Linux Kernel Exploitation Technique: Overwriting modprobe_path" [article]
2021: "Learning Linux Kernel Exploitation" [article] [part 2] [part 3]
2020: "PTMA (Page Table Manipulation Attack): Attacking the core of memory permission" [slides]
2020: "Exploiting Kernel Races Through Taming Thread Interleaving" [slides] [video]
2020: "Locating the kernel PGD on Android/aarch64" by Vitaly Nikolenko [article]
2020: "A Systematic Study of Elastic Objects in Kernel Exploitation" [paper] [video]
2020: "Exploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers" [slides] [paper] [video]
2020: "BlindSide: Speculative Probing: Hacking Blind in the Spectre Era" [paper]
2020: "Linux Kernel Stack Smashing" by Silvio Cesare [article]
2020: "Structures that can be used in kernel exploits" [article]
2019: "The Route to Root: Container Escape Using Kernel Exploitation" by Nimrod Stoler [article]
2019: "Linux Kernel: the ROP Exploit of Stack Overflow in Android Kernel" [article]
2019: "Hands Off and Putting SLAB/SLUB Feng Shui in Blackbox" by Yueqi (Lewis) Chen at Black Hat Europe [slides] [code]
2019: "SLAKE: Facilitating Slab Manipulation for Exploiting Vulnerabilities in the Linux Kernel" by Yueqi (Lewis) Chen and Xinyu Xing [slides] [paper]
2019: "Exploiting Race Conditions Using the Scheduler" by Jann Horn at Linux Security Summit EU [slides] [video]
2019: "Kepler: Facilitating Control-flow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities" [slides] [video] [paper]
2019: "Leak kernel pointer by exploiting uninitialized uses in Linux kernel" by Jinbum Park [slides]
2019: "Kernel IDT priviledge escalation" [article]
2018: "FUZE: Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities" [slides] [paper]
2018: "Linux Kernel universal heap spray" by Vitaly Nikolenko [article]
2018: "Linux-Kernel-Exploit Stack Smashing" [article]
2018: "Entering God Mode - The Kernel Space Mirroring Attack" [article]
2018: "Mirror Mirror: Rooting Android 8 with a Kernel Space Mirroring Attack" by Wang Yong at HitB [slides]
2018: "linux kernel pwn notes" [article]
2018: "Use of timer_list structure in linux kernel exploit" [article]
2018: "Entering God Mode — The Kernel Space Mirroring Attack" [article]
2017: "Escalating Privileges in Linux using Fault Injection" by Niek Timmers and Cristofaro Mune [slides] [video] [paper]
2017: "Kernel Driver mmap Handler Exploitation" by Mateusz Fruba [paper]
2017: "Linux kernel addr_limit bug / exploitation" by Vitaly Nikolenko [video]
2017: "The Stack Clash" by Qualys Research Team [article]
2017: "New Reliable Android Kernel Root Exploitation Techniques" [slides]
2017: "Breaking KASLR with perf" by Lizzie Dixon [article]
2017: "Linux kernel exploit cheetsheet" [article]
2016: "Linux Kernel ROP - Ropping your way to # (Part 1)" by Vitaly Nikolenko [article] [exercise]
2016: "Linux Kernel ROP - Ropping your way to # (Part 2)" by Vitaly Nikolenko [article]
2016: "Exploiting COF Vulnerabilities in the Linux kernel" by Vitaly Nikolenko at Ruxcon [slides]
2016: "Using userfaultfd" by Lizzie Dixon [article]
2016: "Direct Memory Attack the Kernel" by Ulf Frisk at DEF CON [video]
2016: "Randomization Can't Stop BPF JIT Spray" by Elena Reshetova at Black Hat [slides] [video] [paper]
2015: "Kernel Data Attack is a Realistic Security Threat" [paper]
2015: "From Collision To Exploitation: Unleashing Use-After-Free Vulnerabilities in Linux Kernel" [paper]
2015: "Modern Binary Exploitation: Linux Kernel Exploitation" by Patrick Biernat [slides] [exercise]
2013: "Hacking like in the Movies: Visualizing Page Tables for Local Exploitation" at Black Hat
2013: "Exploiting linux kernel heap corruptions" by Mohamed Channam [article]
2012: "Writing kernel exploits" by Keegan McAllister [slides]
2012: "Understanding Linux Kernel Vulnerabilities" by Richard Carback [slides]
2012: "A Heap of Trouble: Breaking the Linux Kernel SLOB Allocator" by Dan Rosenberg [paper]
2012: "Attacking hardened Linux systems with kernel JIT spraying" by Keegan McAllister [article] [code 1] [code 2]
2012: "The Linux kernel memory allocators from an exploitation perspective" by Patroklos Argyroudis [article]
2012: "The Stack is Back" by Jon Oberheide [slides]
2012: "Stackjacking" by Jon Oberheide and Dan Rosenberg [slides]
2011: "Stackjacking Your Way to grsec/PaX Bypass" by Jon Oberheide [article]
2010: "Much ado about NULL: Exploiting a kernel NULL dereference" [article]
2010: "Exploiting Stack Overflows in the Linux Kernel" by Jon Oberheide [article]
2007: "Kernel-mode exploits primer" by Sylvester Keil and Clemens Kolbitsch [paper]
2007: "Attacking the Core : Kernel Exploiting Notes" [article]
2007: "The story of exploiting kmalloc() overflows" [article]
2007: "Linux 2.6 Kernel Exploits" by Stephane Duverger [slides]
2005: "Large memory management vulnerabilities" by Gael Delalleau at CanSecWest [slides]
2005: "The story of exploiting kmalloc() overflows" [article]
2025: "Defeating KASLR by Doing Nothing at All" by Seth Jenkins [article]
2025: "The Journey of Bypassing Ubuntu’s Unprivileged Namespace Restriction" by Pumpkin Chang [article]
2025: "Exploring Kernel Address Leakage via WARN()" by Pumpkin Chang [article]
2025: "Three bypasses of Ubuntu's unprivileged user namespace restrictions" [article]
2025: "A hole in FineIBT protection" by Jonathan Corbet [article]
2024: "SELinux bypasses" [article]
2024: "Page-Oriented Programming: Subverting Control-Flow Integrity of Commodity Operating System Kernels with Non-Writable Code Pages" by Seunghun Han et al. [paper] [slides] [video]
2024: "Defects-in-Depth: Analyzing the Integration of Effective Defenses against One-Day Exploits in Android Kernels" by Lukas Maar et. al [paper] [artifacts]
2024: "Leaking Host KASLR from Guest VMs Using Tagged TLB" by Reno Robert [article]
2024: "TikTag: Breaking ARM's Memory Tagging Extension with Speculative Execution" by Juhee Kim et al. [paper] [code]
2023: "A Closer Look At Freelist Hardening" by Matt Yurkewych [article] [slides]
2023: "MTE As Implemented, Part 3: The Kernel" by Mark Brand [article]
2023: "EPF: Evil Packet Filter" by Di Jin, Vaggelis Atlidakis, and Vasileios P. Kemerlis [paper]
2023: "Bypassing SELinux with init_module" by Sean Pesce [article]
2023: "Linux Kernel: Spectre-v1 gadgets" by Jordy Zomer and Alexandra Sandulescu [article]
2023: "Linux Kernel: Spectre v2 SMT mitigations problem" by Eduardo Vela [article]
2022: "A Dirty Little History: Bypassing Spectre Hardware Defenses to Leak Kernel Data" [slides]
2022: "Tetragone: A Lesson in Security Fundamentals" by Pawel Wieczorkiewicz and Brad Spengler [article]
2021: "A General Approach to Bypassing Many Kernel Protections and its Mitigation" by Yueqi Chen [slides] [video]
2021: "Attacking Samsung RKP" by Alexandre Adamski [article]
2020: "Things not to do when using an IOMMU" by Ilja van Sprundel and Joseph Tartaro [video]
2020: "SELinux RKP misconfiguration on Samsung S20 devices" by Vitaly Nikolenko [article]
2020: "TagBleed: Breaking KASLR on the Isolated Kernel Address Space using Tagged TLBs" [paper]
2020: "Weaknesses in Linux Kernel Heap Hardening" by Silvio Cesare [article]
2020: "An Analysis of Linux Kernel Heap Hardening" by Silvio Cesare [article]
2020: "PAN: Another day, another broken mitigation" by Siguza [article]
2019: "KNOX Kernel Mitigation Bypasses" by Dong-Hoon You at PoC [slides]
2017: "Lifting the (Hyper) Visor: Bypassing Samsung’s Real-Time Kernel Protection" by Gal Beniamini [article]
2016: "Linux Kernel x86-64 bypass SMEP - KASLR - kptr_restric" [article]
2016: "Practical SMEP bypass techniques on Linux" by Vitaly Nikolenko at KIWICON [slides]
2016: "Micro architecture attacks on KASLR" by Anders Fogh" [article]
2016: "Breaking KASLR with Intel TSX" Yeongjin Jang, Sangho Lee and Taesoo Kim at Black Hat [slides] [video]
2016: "Breaking KASLR with micro architecture" by Anders Fogh [article]
2015: "Effectively bypassing kptr_restrict on Android" by Gal Beniamini [article]
2014: "ret2dir: Deconstructing Kernel Isolation" by Vasileios P. Kemerlis, Michalis Polychronakis and Angelos D. Keromytis at Black Hat Europe [paper] [video]
2013: "A Linux Memory Trick" by Dan Rosenberg [article]
2011: "SMEP: What is It, and How to Beat It on Linux" by Dan Rosenberg [article]
2009: "Bypassing Linux' NULL pointer dereference exploit prevention (mmap_min_addr)" [article]
Google kernelCTF writeups and exploits
Assorted advisories by Gyorgy Miru and kutyacica
2026: "From KernelSnitch to Practical msg_msg/pipe_buffer Heap KASLR Leaks" by Lukas Maar [article] [code]
2025: "Vulnerabilities in the /proc Component of the CAN BCM Protocol in the Linux kernel" by Anderson Nascimento [slides] [CVE-2023-52922] [CVE-2025-38003] [CVE-2025-38004]
2025: "Use-after-free in CAN BCM subsystem leading to information disclosure (CVE-2023-52922)" [article] [CVE-2023-52922]
2025: "KernelSnitch: Side-Channel Attacks on Kernel Data Structures" by Lukas Maar et al. [paper] [slides]
2024: "Linux vDSO & VVAR" by Pumpkin Chang [article] [CVE-2023-23586]
2024: "CPU Speculation Vulnerabilities And Mitigations in the Linux Kernel" by Pumpkin Chang [article] [Spectre V1] [Spectre V2]
2024: "Linux Kernel Meltdown Mitigation Analysis" by Pumpkin Chang [article] [Meltdown]
2024: "Out of the kernel, into the tokens" by Max Ammann and Emilio Lopez [article]
2023: "The code that wasn’t there: Reading memory on an Android device by accident" by Man Yue Mo [article] [CVE-2022-25664]
2023: "EntryBleed: A Universal KASLR Bypass against KPTI on Linux" [paper] [CVE-2022-4543]
2022: "EntryBleed: Breaking KASLR under KPTI with Prefetch (CVE-2022-4543)" [article] [CVE-2022-4543]
2022: "Yet another bug into Netfilter" by Arthur Mongodin [article] [CVE-2022-1972]
2022: "The AMD Branch (Mis)predictor: Just Set it and Forget it!" by Pawel Wieczorkiewicz [article] [Spectre]
2022: "The AMD Branch (Mis)predictor Part 2: Where No CPU has Gone Before (CVE-2021-26341)" by Pawel Wieczorkiewicz [article] [Spectre]
2021: "Samsung S10+/S9 kernel 4.14 (Android 10) Kernel Function Address (.text) and Heap Address Information Leak" [article] [CVE-TBD]
2021: "Linux Kernel /proc/pid/syscall information disclosure vulnerability" [article] [CVE-2020-28588]
2021: "Spectre exploits in the "wild"" [article]
2021: "VDSO As A Potential KASLR Oracle" by Philip Pettersson and Alex Radocea [article]
2020: "PLATYPUS: Software-based Power Side-Channel Attacks on x86" [paper]
2019: "CVE-2018-3639 / CVE-2019-7308 - Analysis of Spectre Attacking Linux Kernel ebpf" [article] [CVE-2018-3639, CVE-2019-7308]
2019: "From IP ID to Device ID and KASLR Bypass (Extended Version)" [paper]
2018: "Kernel Memory disclosure & CANVAS Part 1 - Spectre: tips & tricks" [article] [Spectre]
2018: "Kernel Memory disclosure & CANVAS Part 2 - CVE-2017-18344 analysis & exploitation notes" [article] [CVE-2017-18344]
2018: "CVE-2017-18344: Exploiting an arbitrary-read vulnerability in the Linux kernel timer subsystem" by Andrey Konovalov [article] [CVE-2017-18344]
2017: "Linux kernel 2.6.0 to 4.12-rc4 infoleak due to a data race in ALSA timer" by Alexander Potapenko [announcement] [CVE-2017-1000380]
2017: "The Infoleak that (Mostly) Wasn't" by Brad Spengler [article] [CVE-2017-7616]
2016: "Exploiting a Linux Kernel Infoleak to bypass Linux kASLR" [article]
2010: "Linux Kernel pktcdvd Memory Disclosure" by Jon Oberheide [article] [CVE-2010-3437]
2009: "Linux Kernel x86-64 Register Leak" by Jon Oberheide [article] [CVE-2009-2910]
2009: "Linux Kernel getname() Stack Memory Disclosures" by Jon Oberheide [article] [CVE-2009-3001]
2026: "Dissecting and Exploiting Linux LPE Variant: DirtyClone (CVE-2026-43503)" by Eddy Tsalolikhin and Or Peles [article] [CVE-2026-43503]
2026: "19+ Years Hidden, $80,000+ Rewarded: Reporting a Linux Kernel Zero-Day for Google kernelCTF: CVE-2026-43456" by Yuki Koike and Kota Toda [article] [CVE-2026-43456]
2026: "PACKET_EDIT_MEME.c (CVE-2026-46331): yet another Page Cache Poisoning Nightmare" by Massimiliano Oldani [article] [exploit] [CVE-2026-46331]
2026: "IPV6_FRAG_ESCAPE: a unprivileged container / jail escape PoC" by Massimiliano Oldani [article] [exploit] [CVE-UNKNOWN]
2026: "PTRACE_MAY_DREAM: CVE-2026-46333, forgotten too soon, full privesc included" by Massimiliano Oldani [article] [exploit] [CVE-2026-46333]
2026: "Analysis and exploitation of CVE-2022-0995" by Felix [article] [CVE-2022-0995]
2026: "Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215)" by Stan Shaw [article] [CVE-2026-46215]
2026: "Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694)" by Stan Shaw [article] [CVE-2026-31694]
2026: "Bad Epoll: The bug missed by Mythos" by Jaeyoung Chung [article] [CVE-2026-46242]
2026: "Exploiting CVE-2024-1065 via the Page Cache" by Kuzey Arda Bulut [article] [CVE-2024-1065]
2026: "Off By !: Exploiting a Use-after-Free in the Linux Kernel" by Oliver Sieber [article] [CVE-2026-23111]
2026: "CIFSwitch: a non-universal Linux local root vulnerability" by Asim Viladi Oglu Manizada [article] [exploit] [CVE-2026-46243]
2026: "Copy Fail" [summary] [article] [exploit] [CVE-2026-31431]
2026: "CVE-2026-31431: Copy Fail" by Jorge Buzeti [article] [CVE-2026-31431] [Copy Fail]
2026: "Copy Fail: A 4-Byte Page-Cache Write LPE" by Axura [article] [exploit] [CVE-2026-31431] [Copy Fail]
2026: "AF_ALG page-cache cross-container pivot: Part I" by Massimiliano Oldani [article] [exploit] [CVE-2026-31431] [Copy Fail]
2026: "Copy Fail: From Pod to Host." by Juno Im [article] [exploit] [CVE-2026-31431] [Copy Fail]
2026: "Dirty Frag" by Hyunwoo Kim [article] [exploit] [CVE-2026-43284] [CVE-2026-43500] [Dirty Frag]
2026: "copy fail 2: electric boogaloo" by SiCk [article] [exploit] [CVE-2026-43284] [Dirty Frag]
2026: "Discovery and Disclosure of an RxGK Variant in the Linux Kernel Privilege Escalation Vulnerability Family "Dirty Frag"" [article] [CVE-2026-43500] [Dirty Frag]
2026: "Load-Bearing Assumptions: the rxrpc case (CVE-2026-43500) and the constraint that was never there" by Massimiliano Oldani [article] [exploit] [CVE-2026-43500] [Dirty Frag]
2026: "Fragnesia" by William Bowling [article] [variant] [CVE-2026-46300] [Fragnesia]
2026: "DirtyCBC: When Linux Kernel Decrypt-Before-MAC Turns Authenticated Encryption Into a Page-Cache Write" by Kamil Leoniak [article] [CVE-UNKNOWN] [Dirty CBC] [Dirty Decrypt]
2026: "PinTheft" by Aaron Esau [article] [CVE-UNKNOWN]
2026: "From Zero To Root: Attacking Qualcomm DSP Driver" by Xiling Gong [video] [CVE-2025-47394]
2026: "Tile-Based Deferred Rooting: When Your GPU Starts Rendering To Kernel Code Space!" by Xingyu Jin and Martijn Bogaard [slides] [video] [CVE-2025-25180]
2026: "Privilege Escalation via a Page Use-After-Free in Qualcomm's AI Accelerator Linux Kernel Driver" by Lukas Maar [article] [code] [CVE-UNKNOWN]
2026: "Damned OOB" by Mohamed Salem Eddah [article] [CVE-UNKNOWN]
2026: "Logic bug in the Linux kernel's __ptrace_may_access() function" by Qualys Research Team [article] [CVE-2026-46333]
2026: "CVE-2026-31419: Use-After-Free in the Linux Bonding Driver" by Moe Acherir [article] [CVE-2026-31419]
2026: "CVE-2024-0582, or Easy Kernel Exploitation" by Moe Acherir [article] [CVE-2024-0582]
2026: "A 0-Click Exploit Chain For The Pixel 10" by Natalie Silvanovich and Seth Jenkins [video] [article] [CVE-UNKNOWN]
2026: "This Android kernel exploit is way too simple" by Billy Ellis [video] [CVE-UNKNOWN]
2026: "Exploring Android ROOT via CVE-2025-21479" [article] [CVE-2025-21479]
2026: "Codex Hacked a Samsung TV" [article] [CVE-UNKNOWN]
2026: "From a Netfilter Bug to kernelCTF: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10500 Bounty" [article] [CVE-2026-23274]
2026: "Reproducing CVE-2026-23111: How one character can change everything" [article] [CVE-2026-23111]
2026: "Assessing Claude Mythos Preview's cybersecurity capabilities" [article] [CVE-2024-47711]
2026: "kernel alchemy pt. 1: developing exploit primitives with CVE-2025-20741" by hypr [article] [CVE-2025-20741]
2026: "Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs" [article] [CVE-2026-23239]
2026: "Linux Kernel CVE-2022-3910 (h0mbre kCTF bug) LPE" [article] [CVE-2022-3910]
2026: "CrackArmor: Multiple vulnerabilities in AppArmor" by Qualys Research Team [article] [CVE-UNKNOWN]
2026: "PageJack in Action: CVE-2022-0995 exploit" by Jean Vincent [article] [CVE-2022-0995]
2026: "A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets" [article] [CVE-2025-38617]
2026: "Linux Kernel net/sched CAKE Qdisc Use-After-Free LPE" by Noamr [article] [CVE-UNKNOWN]
2026: "[Cryptodev-linux] Page-level UAF exploitation" by nasm [article] [NO-CVE]
2026: "A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave" by Seth Jenkins [article] [CVE-2025-36934]
2026: "Translator/Mali Utgard Hacking" [articles] [exploits] [CVE-UNKNOWN]
2025: "Walkthrough of an N-day Android GPU driver vulnerability" by Angus [video] [CVE-2022-22706]
2025: "A tale of challenging MTE: Rooting Google Pixel with kernel MTE enabled in one shot" by Yong Wang [slides] [CVE-UNKNOWN]
2025: "CVE-2025-38352 (Part 1) - In-the-wild Android Kernel Vulnerability Analysis + PoC" by Faith [article] [CVE-2025-38352]
2025: "CVE-2025-38352 (Part 2) - Extending The Race Window Without a Kernel Patch" by Faith [article] [CVE-2025-38352]
2025: "CVE-2025-38352 (Part 3) - Uncovering Chronomaly" by Faith [article] exploit [CVE-2025-38352]
2025: "Dangling pointers, fragile memory—from an undisclosed vulnerability to Pixel 9 Pro privilege escalation" [article] [CVE-2025-6349] [CVE-2025-8045]
2025: "Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers" by Xingyu Jin and Martijn Bogaard [slides] [video] [CVE-2024-44068] [CVE‑2025‑23244] [CVE-2025-8109] [CVE-2024-49739]
2025: "Déjà Vu in Linux io_uring: Breaking Memory Sharing Again After Generations of Fixes" by Pumpkin Chang [slides] [video] [CVE-2025-21836]
2025: "CUDA de Grâce" by Valentina Palmiotti and Samuel Lovejoy [slides] [video] [CVE-UNKNOWN]
2025: "An RbTree Family Drama: Exploiting a Linux Kernel 0-day Through Red-Black Tree Transformations" by Savino Dicanosa and William Liu [slides] [video] [CVE-2025-38001]
2025: "Race Condition Symphony: From Tiny Idea to Pwnie" by Hyunwoo Kim and Wongi Lee [slides] [CVE-2024-50264]
2025: "Exploiting CVE-2025-21479 on a Samsung S23" by XploitBengineer [article] [CVE-2025-21479]
2025: "LPE via refcount imbalance in the af_unix of Ubuntu's Kernel" by kylebot [article] [CVE-2025-13350]
2025: "Cracking the Pixel 8: Exploiting the Undocumented DSP to Bypass MTE" by Pan Zhenpeng & Jheng Bing Jhong [slides] [video]
2025: "DirtyPipe-CVE-2022-0847" by Abdul Qadir [article] [CVE-2022-0847]
2025: "Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers" by Robin Bastide [article] [CVE-2025-23280] [CVE-2025-23330]
2025: "ksmbd - Exploiting CVE-2025-37947" by Norbert Szetei [article] [CVE-2025-37947] [exploit]
2025: "Analysing a 1-day Vulnerability in the Linux Kernel's TLS Subsystem" by Faith [article] [CVE-2025-39946] [exploit]
2025: "Analyze Linux Kernel 1-day 0aeb54ac" by Pumpkin Chang [article] [CVE-2025-39946]
2025: "Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel" by Alexander Popov [article] [CVE-2024-50264]
2025: "A Walk Through Android Physical Memory: CVE-2025-21479 Privilege Escalation" [article] [comment] [CVE-2025-21479]
2025: "netfilter: ipset: Missing Range Check LPE" [article] [CVE-2024-53141]
2025: "From Chrome renderer code exec to kernel with MSG_OOB" by Jann Horn [article] [CVE-2025-38236]
2025: "[CVE-2025-38001] Exploiting All Google kernelCTF Instances And Debian 12 With A 0-Day For $82k: An RBTree Family Drama (Part One: LTS & COS)" by D3vil [article] [CVE-2025-38001]
2025: "Linux Kernel Pipapo Set Double Free LPE" by Slavin and Le Premier Homme [article] [CVE-UNKNOWN]
2025: "The tragedy of Netfilter Tunnel: CVE-2025-22056" [article] [CVE-2025-22056]
2025: "Solo: A Pixel 6 Pro Story (When one bug is all you need)" by Lin Ze Wei [article] [CVE-2023-48409] [CVE-2023-26083]
2025: "Bypassing MTE with CVE-2025-0072" by Man Yue Mo [article] [CVE-2025-0072]
2025: "Skin in the Game: Survival of GPU IOMMU Irregular Damage" by Fish and Ling Hanqin [video] [CVE-2022-38181] [CVE-2023-6241] [CVE-2023-33107] [CVE-2024-23372] [CVE-2024-31333]
2025: "[CVE-2025-37752] Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds" by D3vil [article] [CVE-2025-37752]
2025: "Linux Kernel Exploitation: CVE-2025-21756: Attack of the Vsock" by Michael Hoefler [article] [CVE-2025-21756]
2025: "CVE-2025-21692 nday writeup" by volticks [article] [exploit] [CVE-2025-21756]
2025: "Exploiting CVE-2024-0582 via the Dirty Pagetable Method" by Kuzey Arda Bulut [article] [CVE-2024-0582]
2025: "Kernel-Hack-Drill: Environment For Developing Linux Kernel Exploits" by Alexander Popov [slides] [CVE-2024-50264]
2025: "Linux kernel hfsplus slab-out-of-bounds Write" by Attila Szasz [article] slides [CVE-2025-0927]
2025: "CVE-2024-53141: an OOB Write Vulnerability in Netfiler Ipset" by Pumpkin Chang [article] [CVE-2024-53141]
2025: "Patch-Gapping the Google Container-Optimized OS for $0" by h0mbre [article] [CVE-UNKNOWN]
2025: "Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793)" by Ng Zhi Yang [article] [CVE-2022-22706] [CVE-2021-39793]
2025: "Introduction to Android GPU Vulnerability Attack and Defense" [article] [CVE-2024-23380]
2024: "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit" by Seth Jenkins [article] video [CVE-2024-38402] [CVE-2024-21455] [CVE-2024-33060] [CVE-2024-49848] [CVE-2024-43047]
2024: "OtterRoot: Netfilter Universal Root 1-day" by Pedro Pinto [article] [CVE-2024-26809]
2024: "How I use a novel approach to exploit a limited OOB on Ubuntu at Pwn2Own Vancouver 2024" by Pumpkin Chang [slides] [CVE-UNKNOWN]
2024: "GPUAF - Two ways of Rooting All Qualcomm based Android phones" by Pan Zhenpeng and Jheng Bing Jhong [slides] [CVE-2024-23380] [CVE-2024-23373]
2024: "Breaking through the cage: Get Android universal root by B-PUAF" by Lu Yutao and Ling Hanqin [slides] [CVE-2024-46740]
2024: "Unleashing a 0day: Pivoting Capabilities and Conquering the Linux Kernel" by Pedro Pinto [slides] [video] [CVE-2024-41010]
2024: "Utilizing Cross-CPU Allocation to Exploit Preempt-Disabled Linux Kernel" by Mingi Cho and Wongi Lee [slides] [CVE-2023-31248] [video] [CVE-2024-36978]
2024: "1day vuln dev: DirtyCOW" [video] [CVE-2016-5195]
2024: "Race conditions in Linux Kernel perf events" [code] [CVE-UNKNOWN]
2024: "CVE-2020-27786 (Race Condition + Use-After-Free)" by ii4gsp [article] [CVE-2020-27786]
2024: "GPUAF Using a general GPU exploit tech to attack Pixel8" by Pan Zhenpeng and Jheng Bing Jhong [slides] [video] [CVE-UNKNOWN]
2024: "Linux Kernel taprio OOB" [article] [CVE-2024-36974]
2024: "CVE-2022-22265 Samsung npu driver" by Javier P Rufo [article] [CVE-2022-22265]
2024: "The Way to Android Root: Exploiting Your GPU On Smartphone" by Xiling Gong, Xuan Xing, and Eugene Rodionov [slides] [video] [CVE-2024-23380]
2024: "Clash, Burn, and Exploit: Manipulate Filters to Pwn kernelCTF" by HexRabbit [slides] [video] [CVE-2024-26925]
2024: "A deep dive into CVE-2023-2163: How we found and fixed an eBPF Linux Kernel Vulnerability" by Juan Jose Lopez Jaimez and Meador Inge [article] [CVE-2023-2163]
2024: "Vulnerability in the eBPF verifier register limit tracking" by Juan Jose Lopez Jaimez [CVE-2024-41003]
2024: "Android Binder Attack Matrix" by Utkarsh [article] [part 2] [part 3] [part 4] [part 5]
2024: "Driving forward in Android drivers" by Seth Jenkins [article] [video] [CVE-2023-32837] [CVE-2023-32832]
2024: "Attacking Android Binder: Analysis and Exploitation of CVE-2023-20938" by Eugene Rodionov, Zi Fan Tan, and Gulshan Singh [article] [CVE-2023-20938]
2024: "How to Fuzz Your Way to Android Universal Root: Attacking Android Binder" by Eugene Rodionov and Zi Fan Tan [slides] [video] [CVE-2023-20938]
2024: "Linux Kernel nft_validate_register_store Integer Overflow Privilege Escalation" [article] [CVE-UNKNOWN]
2024: "Game of Cross Cache: Let's win it in a more effective way!" by Le Wu [slides] [video] [CVE-2023-21400]
2024: "LinkDoor: A Hidden Attack Surface in the Android Netlink Kernel Modules" by Chao Ma et al. [slides] [CVE-2023-32878] [CVE-2023-32882]
2024: "Flipping Pages: An analysis of a new Linux vulnerability in nf_tables and hardened exploitation techniques" by notselwyn [article] [exploit] [CVE-2024-1086]
2024: "64 bytes and a ROP chain – A journey through nftables" by Davide Ornaghi [article] [part 2] [exploit] [CVE-2023-0179]
2024: "Mind the Patch Gap: Exploiting an io_uring Vulnerability in Ubuntu" by Oriol Castejon [CVE-2024-0582]
2024: "CVE-2022-2586 Writeup" [article] [CVE-2022-2586]
2024: "n_gsm_exploit" [article]
2024: "The tale of a GSM Kernel LPE" [article] [exploit] [notes] [discussion]
2024: "Gaining kernel code execution on an MTE-enabled Pixel 8" by Man Yue Mo [article] [exploit] [CVE-2023-6241]
2024: "Mali GPU Kernel LPE: Android 14 kernel exploit for Pixel7/8 Pro" by Mohamed Ghannam [article] [CVE-2023-26083]
2024: "CVE-2023-5178: exploiting Linux kernel NVMe-oF-TCP driver on Ubuntu 23.10" by rockrid3r [article] [CVE-2023-5178] [exploit]
2023: "Exploiting null-derefs" by Seth Jenkins [slides] [CVE-UNKNOWN]
2023: "Linux Kernel GSM Multiplexing Race Condition Local Privilege Escalation Vulnerability (CVE-2023-6546)" by Nassim Asrir [CVE-2023-6546]
2023: "CVE-2022-27666: My file your memory" by Erin Avllazagaj [article] [CVE-2022-27666]
2023: "Conquering the memory through io_uring - Analysis of CVE-2023-2598" [article] [exploit] [CVE-2023-2598]
2023: "Conquering a Use-After-Free in nf_tables: Detailed Analysis and Exploitation of CVE-2022-32250" by Yordan Stoychev [article] [CVE-2022-32250]
2023: "One shot, Triple kill: Pwning all three Google kernelCTF instances with a single 1-day Linux vulnerability" [slides] [abstract] [CVE-2023-3390]
2023: "Exploiting a bug in the Linux kernel with Zig" by Richard Palethorpe [article] [video] [CVE-2023-0461]
2023: "Escaping the Google kCTF Container with a Data-Only Exploit" by h0mbre [article] [CVE-2022-3910]
2023: "Analyzing a Modern In-the-wild Android Exploit" by Seth Jenkins [article] [CVE-2023-0266] [CVE-2023-26083]
2023: "Old bug, shallow bug: Exploiting Ubuntu at Pwn2Own Vancouver 2023" by Tanguy Dubroca [article] [CVE-2023-35001]
2023: "Linux Kernel Exploit (CVE-2022–32250) with mqueue" [article] [CVE-2022-32250]
2023: "Bad io_uring: A New Era of Rooting for Android" by Zhenpeng Lin [slides] [video] [CVE-2022-20409]
2023: "CVE-2023-3389 - LinkedPoll" by Querijn Voet [article] [CVE-2023-3389]
2023: "GameOver(lay): Easy-to-exploit local privilege escalation vulnerabilities in Ubuntu Linux" by Sagi Tzadik and Shir Tamari [article] [CVE-2023-2640] [CVE-2023-32629]
2023: "StackRot (CVE-2023-3269): Linux kernel privilege escalation vulnerability" by Ruihan Li [article] [CVE-2023-3269]
2023: "No CVE for this. It has never been in the official kernel" [article]
2023: "CVE-2020-27786 exploitation userfaultfd + patching file struct etc passwd" [article] [CVE-2020-27786]
2023: "Breaking the Code - Exploiting and Examining CVE-2023-1829 in cls_tcindex Classifier Vulnerability" by Vu Thi Lan [article] [CVE-2023-1829]
2023: "CVE-2023-2008 - Analyzing and exploiting a bug in the udmabuf driver" [article] [CVE-2023-2008]
2023: "Rooting with root cause: finding a variant of a Project Zero bug" by Man Yue Mo [article] [CVE-2022-46395]
2023: "Racing Against the Lock: Exploiting Spinlock UAF in the Android Kernel" by Moshe Kol [article] [slides] [video] [exploit] [CVE-2022-20421]
2023: "Two bugs with one PoC: Roo2ng Pixel 6 from Android 12 to Android 1" by Yong Wang [slides] [CVE-2021-28664]
2023: "The OverlayFS vulnerability CVE-2023-0386: Overview, detection, and remediation" [article] [CVE-2023-0386]
2023: "Pwning Pixel 6 with a leftover patch" by Man Yue Mo [article] [GHSL-2023-005]
2023: "Revisiting CVE-2017-11176" by Nils Ole Timm [article] [CVE-2017-11176]
2023: "Rooting the FiiO M6" by Jack Maginnes [article] [part 2] [video]
2023: "Exploiting CVE-2021-3490 for Container Escapes" by Karsten Kyonig [article] [CVE-2021-3490]
2023: "Pwning the all Google phone with a non-Google bug" [article] [CVE-2022-38181]
2023: "CVE-2023-0386 analysis and exploitation" by chenaotian [article] [CVE-2023-0386]
2022: "Escaping containers using the Dirty Pipe vulnerability" by Eric Mountain et. al [article] [CVE-2022-0847]
2022: "How we use Dirty Pipe to get reverse root shell on Android Emulator and Pixel 6" by LiN and YingMuo [slides] [video] [CVE-2022-0847]
2022: "Linux kernel io_uring module pbuf_ring vulnerability and privilege escalation 0day" [article [CVE-UNKNOWN]
2022: "CVE-2022-1015: A validation flaw in Netfilter leading to Local Privilege Escalation" by Yordan Stoychev [article] [CVE-2022-1015]
2022: "CVE-2022-22265: Samsung NPU device driver double free in Android" by Xingyu Jin [article] [CVE-2022-22265]
2022: "Linux Kernel: Exploiting a Netfilter Use-after-Free in kmalloc-cg" by Sergi Martinez [article] [CVE-2022-32250]
2022: "Exploiting CVE-2022-42703 - Bringing back the stack attack" by Seth Jenkins [article] [CVE-2022-42703]
2022: "CVE-2022-2602: DirtyCred File Exploitation applied on an io_uring UAF" [article] [CVE-2022-2602]
2022: "DirtyCred Remastered: how to turn an UAF into Privilege Escalation" [article] [CVE-2022-2602]
2022: "Exploiting cross table object reference in Linux Netfilter table (NFT) module" [slides] [CVE-2022-2078] [CVE-2022-2586]
2022: "Linux Kernel n-day exploit development" [article] [CVE-2020-27786]
2022: "Linux Kernel Exploit Development: 1day case study" by Alessandro Groppo [article] [CVE-2020-27786]
2022: "[CVE-2022-1786] A Journey To The Dawn" [article] [CVE-2022-1786]
2022: "A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain" by Maddie Stone [article] [CVE-2021-25369] [CVE-2021-25370]
2022: "Attacking the Android kernel using the Qualcomm TrustZone" by Tamir Zahavi-Brunner [article] [video] [CVE-2021-1961]
2022: "SETTLERS OF NETLINK: Exploiting a limited UAF in nf_tables (CVE-2022-32250)" [article] [slides] [video] [CVE-2022-32250]
2022: "Linux Kernel Exploit (CVE-2022-32250) with mqueue" [article] [CVE-2022-32250]
2022: "N-day exploit for CVE-2022-2586: Linux kernel nft_object UAF" by Alejandro Guerrero [article] [CVE-2022-2586]
2022: "Monitoring Surveillance Vendors: A Deep Dive into In-the-Wild Android Full Chains in 2021" [slides] [CVE-2021-0920]
2022: "CVE-2022-29582: An io_uring vulnerability" by Awarau and David Bouman [article] [CVE-2022-29582]
2022: "Linux kernel io_uring module pbuf_ring vulnerability and privilege escalation 0day" [article]
2022: "Corrupting memory without memory corruption" by Man Yue Mo [article] [CVE-2022-20186]
2022: "[CVE-2022-34918] A crack in the Linux firewall" by Arthur Mongodin [article] [CVE-2022-34918] [exploit]
2022: "CVE-2022-34918: netfilter analysis notes" [article] [CVE-2022-34918]
2022: "Practice of USMA-based Kernel Universal EXP Writing Ideas on CVE-2022-34918" [article] [CVE-2022-34918]
2022: "The Android kernel mitigations obstacle race" by Man Yue Mo [article] [CVE-2022-22057]
2022: "io_uring - new code, new bugs, and a new exploit technique" by Lam Jun Rong [article] [CVE-2021-41073]
2022: "Exploration of the Dirty Pipe Vulnerability (CVE-2022-0847)" by lolcads [article] [CVE-2022-0847]
2022: "DirtyPipe-Android/TECHNICAL-DETAILS.md" by polygraphene [article] [CVE-2022-0847]
2022: "Weaponizing dirtypipe on android" by Giovanni Rocca [slides] [exploit] [CVE-2022-0847]
2022: "How The Tables Have Turned: An analysis of two new Linux vulnerabilities in nf_tables" by David Bouman [CVE-2022-1015] [CVE-2022-1016]
2022: "The Discovery and Exploitation of CVE-2022-25636" by Nick Gregory [article] [CVE-2022-25636]
2022: "CVE-2022-27666: Exploit esp6 modules in Linux kernel" by ETenal [article] [CVE-2022-27666]
2022: "Put an io_uring on it: Exploiting the Linux Kernel" by Valentina Palmiotti [article] [CVE-2021-41073]
2022: "The Dirty Pipe Vulnerability" by Max Kellermann [article] [CVE-2022-0847]
2022: "CVE-2022-0185 - Winning a $31337 Bounty after Pwning Ubuntu and Escaping Google's KCTF Containers" [article] [CVE-2022-0185]
2022: "CVE-2022-0185: Linux kernel slab out-of-bounds write: exploit and writeup" by Alejandro Guerrero [article] [CVE-2022-0185]
2022: "CVE-2022-0185: A Case Study" [article] [CVE-2022-0185]
2022: "CVE-2022-0185: Analysis and utilization and thinking and practice of new primitives for pipe" [article] [CVE-2022-0185]
2022: "Linux kernel Use-After-Free (CVE-2021-23134) PoC" [article] [CVE-2021-23134]
2022: "Exploiting CVE-2021-26708 (Linux kernel) with ssh" [article] [CVE-2021-26708]
2022: "exploiting CVE-2019-2215" by cutesmilee [article] [CVE-2019-2215]
2022: "Linux Kernel PWN | 02 CVE-2009-1897" [article] [CVE-2009-1897]
2021: "Typhoon Mangkhut: One-click Remote Universal Root Formed with Two Vulnerabilities" [slides] [video] [CVE-2020-0423]
2021: "Analysis and Exploitation of CVE-2021-28664 for Android Privilege Escalation" by Bernard Lampe [slides] [CVE-2021-28664]
2021: "Your Trash Kernel Bug, My Precious 0-day" by Zhenpeng Lin [slides] [CVE-2021-3715]
2021: "[CVE-2021-42008] Exploiting A 16-Year-Old Vulnerability In The Linux 6pack Driver" [article] [CVE-2021-42008]
2021: "PWN2OWN Local Escalation of Privilege Category, Ubuntu Desktop Exploit" [article] [CVE-TBD]
2021: "Reversing and Exploiting Samsung's NPU" by Maxime Peterlin [article] [part 2] slides
2021: "Fall of the machines: Exploiting the Qualcomm NPU (neural processing unit) kernel driver" by Man Yue Mo [article] [CVE-2021-1940, CVE-2021-1968, CVE-2021-1969]
2021: "Exploiting CVE-2021-43267" by Blasty [article] [CVE-2021-43267]
2021: "How a simple Linux kernel memory corruption bug can lead to complete system compromise" by Jann Horn [article] [CVE-TBD]
2021: "SuDump: Exploiting suid binaries through the kernel" by Itai Greenhut [article] [CVE-TBD]
2021: "CVE-2021-34866 Writeup" by HexRabbit [article] [CVE-2021-34866]
2021: "Kernel Pwning with eBPF: a Love Story" by Valentina Palmiotti [article] [CVE-2021-3490]
2021: "The Art of Exploiting UAF by Ret2bpf in Android Kernel" by Xingyu Jin and Richard Neal [article] [slides] [video] [CVE-2021-0399]
2021: "Internal of the Android kernel backdoor vulnerability" [article] [CVE-2021-28663]
2021: "Escape from chrome sandbox to root" [article] [CVE-2020-0423]
2021: "CVE-2017-11176" by Maher Azzouzi [article] [CVE-2017-11176]
2021: "Sequoia: A deep root in Linux's filesystem layer (CVE-2021-33909)" by Qualys Research Team [article] [CVE-2021-33909]
2021: "CVE-2021-22555: Turning \x00\x00 into 10000$" by Andy Nguyen [CVE-2021-22555, article]
2021: "Exploitation of a double free vulnerability in Ubuntu shiftfs driver (CVE-2021-3492)" by Vincent Dehors [article] [CVE-2021-3492]
2021: "CVE-2021-20226 a reference counting bug which leads to local privilege escalation in io_uring" [article] [CVE-2021-20226]
2021: "CVE-2021-32606: CAN ISOTP local privilege escalation" [article] [CVE-2021-32606]
2021: "CVE-2021-3609: CAN BCM local privilege escalation" [article] [announcement] [CVE-2021-3609]
2021: "Blue Klotski (CVE-2021-3573) and the story for fixing" by f0rm2l1n [article] [announcement] [CVE-2021-3573]
2021: "ZDI-20-1440: An Incorrect Calculation Bug in the Linux Kernel eBPF Verifier" by Lucas Leong [article]
2021: "ZDI-20-1440 Writeup" by HexRabbit [article]
2021: "SSD Advisory – OverlayFS PE" [article] [CVE-2021-3493]
2021: "[BugTales] A Nerve-Racking Bug Collision in Samsung's NPU Driver" by Gyorgy Miru [article] [CVE-2020-28343, SVE-2020-18610]
2021: "CVE-2021-20226: A Reference-Counting Bug in the Linux Kernel io_uring Subsystem" by Lucas Leong [article] [CVE-2021-20226]
2021: "One day short of a full chain: Part 1 - Android Kernel arbitrary code execution" by Man Yue Mo [article] [GHSL-2020-375]
2021: "New Old Bugs in the Linux Kernel" [article] [CVE-2021-27365, CVE-2021-27363, CVE-2021-27364]
2021: "Four Bytes of Power: exploiting CVE-2021-26708 in the Linux kernel" [article] [slides] [video] [CVE-2021-26708]
2021: "Improving the exploit for CVE-2021-26708 in the Linux kernel to bypass LKRG" by Alexander Popov [article] [slides] [video]
2021: "Gaining root access in Linux using the CVE-2021-26708 vulnerability" by Markel Azpeitia Loiti [paper]
2021: "The curious case of CVE-2020-14381" [article] [CVE-2020-14381]
2021: "Galaxy's Meltdown - Exploiting SVE-2020-18610" [article] [CVE-2020-28343, SVE-2020-18610]
2021: "In-the-Wild Series: Android Exploits" by Mark Brand [article]
2021: "Exploiting CVE-2014-3153 (Towelroot)" by Elon Gliksberg [article] [CVE-2014-3153]
2021: "CVE-2014-3153" by Maher Azzouzi [article] [CVE-2014-3153]
2020: "An iOS hacker tries Android" by Brandon Azad [article] [CVE-2020-28343, SVE-2020-18610]
2020: "Exploiting a Single Instruction Race Condition in Binder" [article] [CVE-2020-0423]
2020: "Three Dark clouds over the Android kernel" by Jun Yao [slides] [CVE-2020-3680]
2020: "Kernel Exploitation With A File System Fuzzer" [slides] [video] [CVE-2019-19377]
2020: "Finding and exploiting a bug (LPE) in an old Android phone" by Brandon Falk [stream] [part 2] [summary]
2020: "CVE-2020-14386: Privilege Escalation Vulnerability in the Linux kernel" by Or Cohen [article] [CVE-2020-14386]
2020: "Attacking the Qualcomm Adreno GPU" by Ben Hawkes [article] [CVE-2020-11179]
2020: "TiYunZong: An Exploit Chain to Remotely Root Modern Android Devices" by Guang Gong at Black Hat [slides] [paper] [CVE-2019-10567]
2020: "Binder - Analysis and exploitation of CVE-2020-0041" by Jean-Baptiste Cayrou [article] [CVE-2020-0041]
2020: "Binder IPC and its vulnerabilities" by Jean-Baptiste Cayrou at THCON [slides] [CVE-2019-2215, CVE-2019-2025, CVE-2019-2181, CVE-2019-2214, CVE-2020-0041]
2020: "Exploiting CVE-2020-0041 - Part 2: Escalating to root" by Eloi Sanfelix and Jordan Gruskovnjak [article] [CVE-2020-0041]
2020: "A bug collision tale" by Eloi Sanfelix at OffensiveCon [slides] [video] [CVE-2019-2025]
2020: "CVE-2020-8835: Linux Kernel Privilege Escalation via Improper eBPF Program Verification" by Manfred Paul [article] [CVE-2020-8835]
2020: "Mitigations are attack surface, too" by Jann Horn [article]
2020: "CVE-2019-18683: Exploiting a Linux kernel vulnerability in the V4L2 subsystem" by Alexander Popov [article] [slides] [CVE-2019-18683]
2020: "Multiple Kernel Vulnerabilities Affecting All Qualcomm Devices" by Tamir Zahavi-Brunner [article] [CVE-2019-14040, CVE-2019-14041]
2019: "CVE-2017-16995 Analysis - eBPF Sign Extension LPE" by senyuuri [article] [CVE-2017-16995]
2019: "Kernel Research / mmap handler exploitation" by deshal3v [article] [CVE-2019-18675]
2019: "Bad Binder: Android In-The-Wild Exploit" by Maddie Stone [article] [CVE-2019-2215]
2019: "Analyzing Android's CVE-2019-2215 (/dev/binder UAF)" [article] [CVE-2019-2215]
2019: "Stream Cut: Android Kernel Exploitation with Binder Use-After-Free (CVE-2019-2215)" [video] [CVE-2019-2215]
2019: "CVE-2019-2215 - Android kernel binder vulnerability analysis" [article] [CVE-2019-2215]
2019: "Deep Analysis of Exploitable Linux Kernel Vulnerabilities" by Tong Lin and Luhai Chen at Linux Security Summit EU [video] [CVE-2017-16995, CVE-2017-10661]
2019: "Tailoring CVE-2019-2215 to Achieve Root" by Grant Hernandez [article] [CVE-2019-2215]
2019: "From Zero to Root: Building Universal Android Rooting with a Type Confusion Vulnerability" by Wang Yong [slides] [CVE-2018-9568, WrongZone]
2019: "KARMA takes a look at offense and defense: WrongZone from exploitation to repair" [article] [CVE-2018-9568, WrongZone]
2019: "Android Binder: The Bridge To Root" by Hongli Han and Mingjian Zhou [slides] [CVE-2019-2025]
2019: "The ‘Waterdrop’ in Android: A Binder Kernel Vulnerability" by Hongli Han [article] [CVE-2019-2025]
2019: "An Exercise in Practical Container Escapology" by Nick Freeman [article] [CVE-2017-1000112]
2019: "Taking a page from the kernel's book: A TLB issue in mremap()" by Jann Horn [article] [CVE-2018-18281]
2019: "CVE-2018-18281 - Analysis of TLB Vulnerabilities in Linux Kernel" [article]
2019: "Analysis of Linux xfrm Module Cross-Border Read-Write Escalation Vulnerability (CVE-2017-7184)" [article] [CVE-2017-7184]
2019: "Analysis of Escalation Vulnerability Caused by Integer Extension of Linux ebpf Module (CVE-2017-16995)" [article] [CVE-2017-16995]
2019: "Linux kernel 4.20 BPF integer overflow vulnerability analysis" [article]
2019: "Attacking DRM subsystem to gain kernel privilege on Chromebooks" by Di Shen [slides] [video] [CVE-2019-16508]
2018: "Linux kernel 4.20 BPF integer overflow-heap overflow vulnerability and its exploitation" [article]
2018: "CVE-2017-11176: A step-by-step Linux Kernel exploitation [article] [CVE-2017-11176]
2018: "A cache invalidation bug in Linux memory management" by Jann Horn [article] [CVE-2018-17182]
2018: "Dissecting a 17-year-old kernel bug" by Vitaly Nikolenko at beVX [slides] [CVE-2018-6554, CVE-2018-6555]
2018: "SSD Advisory – IRDA Linux Driver UAF" [article] [CVE-2018-6554, CVE-2018-6555]
2018: "Integer overflow in Linux's create_elf_tables()" [announcement] [CVE-2018-14634]
2018: "MMap Vulnerabilities – Linux Kernel" [article] [CVE-2018-8781]
2018: "Ubuntu kernel eBPF 0day analysis" [article] [CVE-2017-16995]
2018: "eBPF and Analysis of the get-rekt-linux-hardened.c Exploit for CVE-2017-16995" [article] [CVE-2017-16695]
2017: "Challenge Impossible -- Multiple Exploit On Android" by Hanxiang Wen and Xiaodong Wang [slides] [CVE-2017-0437]
2017: "CVE-2017-1000112: Exploiting an out-of-bounds bug in the Linux kernel UFO packets" by Andrey Konovalov [article] [CVE-2017-1000112]
2017: "Linux Kernel Vulnerability Can Lead to Privilege Escalation: Analyzing CVE-2017-1000112" by Krishs Patil [article] [CVE-2017-1000112]
2017: "Adapting the POC for CVE-2017-1000112 to Other Kernels" [article] [CVE-2017-1000112]
2017: "The Art of Exploiting Unconventional Use-after-free Bugs in Android Kernel" by Di Shen [slides] [CVE-2017-0403, CVE-2016-6787] [video]
2017: "Exploiting CVE-2017-5123 with full protections. SMEP, SMAP, and the Chrome Sandbox!" by Chris Salls [article] [CVE-2017-5123]
2017: "Exploiting CVE-2017-5123" by Federico Bento [article] [CVE-2017-5123]
2017: "Escaping Docker container using waitid() – CVE-2017-5123" by Daniel Shapira [article] [CVE-2017-5123]
2017: "LKE v4.13.x - waitid() LPE" by HyeongChan Kim [article] [CVE-2017-5123]
2017: "Exploiting on CVE-2016-6787" [article] [CVE-2016-6787]
2017: "Race For Root: The Analysis Of The Linux Kernel Race Condition Exploit" by Alexander Popov [video] [CVE-2017-2636]
2017: "Race For Root: The Analysis Of The Linux Kernel Race Condition Exploit" by Alexander Popov [slides] [CVE-2017-2636]
2017: "CVE-2017-2636: exploit the race condition in the n_hdlc Linux kernel driver bypassing SMEP" by Alexander Popov [article] [CVE-2017-2636]
2017: "CVE-2017-2636: local privilege escalation flaw in n_hdlc" by Alexander Popov [announcement] [CVE-2017-2636]
2017: "Dirty COW" [summary] [exploit] [CVE-2016-5195]
2017: "Dirty COW and why lying is bad even if you are the Linux kernel" [article] [CVE-2016-5195]
2017: "NDAY-2017-0103: Arbitrary kernel write in sys_oabi_epoll_wait" by Zuk Avraham [article] [CVE-2016-3857]
2017: "NDAY-2017-0106: Elevation of Privilege in NVIDIA nvhost-vic driver" by Zuk Avraham [article] [CVE-2016-2434]
2017: "PWN2OWN 2017 Linux kernel privilege escalation analysis" [article] [CVE-2017-7184]
2017: "Exploiting the Linux kernel via packet sockets" by Andrey Konovalov [article] [CVE-2017-7308]
2017: "Solving a post exploitation issue with CVE-2017-7308" [article] [CVE-2017-7308]
2017: "NDAY-2017-0105: Elevation of Privilege Vulnerability in MSM Thermal Drive" by Zuk Avraham [article] [CVE-2016-2411]
2017: "NDAY-2017-0102: Elevation of Privilege Vulnerability in NVIDIA Video Driver" by Zuk Avraham [article] [CVE-2016-2435]
2017: "CVE-2017-6074: Exploiting a double-free in the Linux kernel DCCP sockets" by Andrey Konovalov [article] [CVE-2017-6074]
2016: "CVE-2016-8655 Linux af_packet.c race condition (local root)" by Philip Pettersson [announcement] [CVE-2016-8655]
2016: "Rooting Every Android From Extension To Exploitation" by Di Shen and James Fang at Black Hat [slides] [article] [CVE-2015-0570, CVE-2016-0820, CVE-2016-2475, CVE-2016-8453]
2016: "Talk is Cheap, Show Me the Code" by James Fang, Di Shen and Wen Niu [slides] [CVE-2015-1805]
2016: "CVE-2016-3873: Arbitrary Kernel Write in Nexus 9" by Sagi Kedmi [article] [CVE-2016-3873]
2016: "Exploiting Recursion in the Linux Kernel" by Jann Horn [article] [CVE-2016-1583]
2016: "ANALYSIS AND EXPLOITATION OF A LINUX KERNEL VULNERABILITY (CVE-2016-0728)" By Perception Point Research Team [article] [CVE-2016-0728]
2016: "CVE20160728 Exploit Code Explained" by Shilong Zhao [article] [CVE-2016-0728]
2016: "CVE-2016-0728 vs Android" by Collin Mulliner [article] [CVE-2016-0728]
2016: "Notes about CVE-2016-7117" by Lizzie Dixon [article] [CVE-2016-7117]
2016: "CVE-2016-2384: exploiting a double-free in the usb-midi linux kernel driver" by Andrey Konovalov [article] [CVE-2016-2384]
2016: "CVE-2016-6187: Exploiting Linux kernel heap off-by-one" by Vitaly Nikolenko [article] [CVE-2016-6187]
2016: "CVE-2014-2851 group_info UAF Exploitation" by Vitaly Nikolenko [article] [CVE-2014-2851]
2016: "Perf: From Profiling To Kernel Exploiting" by Wish Wu at HITB Ams [slides] [video] [CVE-2016-0819]
2016: "QUADROOTER: NEW VULNERABILITIES AFFECTING OVER 900 MILLION ANDROID DEVICES" [article] [CVE-2016-2503, CVE-2106-2504, CVE-2016-2059, CVE-2016-5340]
2016: "STUMPING THE MOBILE CHIPSET: New 0days from down under" by Adam Donenfeld at DEF CON [slides] [CVE-2016-2503, CVE-2106-2504, CVE-2016-2059, CVE-2016-5340]
2015: "Android linux kernel privilege escalation vulnerability and exploit (CVE-2014-4322)" by Gal Beniamini [article] [CVE-2014-4322]
2015: "Exploiting "BadIRET" vulnerability" by Rafal Wojtczuk [article] [CVE-2014-9322]
2015: "Follow-up on Exploiting "BadIRET" vulnerability (CVE-2014-9322)" by Adam Zabrocki [article] [CVE-2014-9322]
2015: "Ah! Universal Android Rooting Is Back" by Wen Xu at Black Hat [slides] [video] [paper] [CVE-2015-3636]
2015: "When is something overflowing" by Keen Team [slides]
2015: "Exploiting the DRAM rowhammer bug to gain kernel privileges" by Mark Seaborn and Thomas Dullien [article] [Rowhammer]
2015: "CVE-2014-4943 - PPPoL2TP DoS Analysis" by Vitaly Nikolenko [article] [CVE-2014-4943]
2015: "CVE-2015-0568: Use-After-Free Vulnerability in the Camera Driver of Qualcomm MSM 7x30" [article] [CVE-2015-0568]
2014: "Exploiting CVE-2014-0196 a walk-through of the Linux pty race condition PoC" by Samuel Gross [article] [CVE-2014-0196]
2014: "CVE-2014-4014: Linux Kernel Local Privilege Escalation "exploitation"" by Vitaly Nikolenko [article] [CVE-2014-4014]
2014: "CVE-2014-4699: Linux Kernel ptrace/sysret vulnerability analysis" by Vitaly Nikolenko [article] [CVE-2014-4699]
2014: "How to exploit the x32 recvmmsg() kernel vulnerability CVE 2014-0038" by Samuel Gross [article] [CVE-2014-0038]
2014: "Exploiting the Futex Bug and uncovering Towelroot" [article] [CVE-2014-3153]
2014: "CVE-2014-3153 Exploit" by Joel Eriksson [article] [CVE-2014-3153]
2013: "Privilege Escalation Kernel Exploit" by Julius Plenz [article] [CVE-2013-1763]
2013: "A closer look at a recent privilege escalation bug in Linux (CVE-2013-2094)" by Joe Damato [article] [CVE-2013-2094]
2012: "Linux Local Privilege Escalation via SUID /proc/pid/mem Write" by Jason Donenfeld [article] [CVE-2012-0056]
2011: "Kernel Exploitation Via Uninitialized Stack" by Kees Cook at DEF CON [slides] [video] [CVE-2010-2963]
2010: "CVE-2010-2963 v4l compat exploit" by Kees Cook [article] [CVE-2010-2963]
2010: "Exploiting large memory management vulnerabilities in Xorg server running on Linux" by Rafal Wojtczuk [article] [CVE-2010-2240]
2010: "CVE-2007-4573: The Anatomy of a Kernel Exploit" by Nelson Elhage [article] [CVE-2007-4573]
2010: "Linux Kernel CAN SLUB Overflow" by Jon Oberheide [article] [CVE-2010-2959]
2010: "af_can linux kernel overflow" by Ben Hawkes [article] [CVE-2010-2959]
2010: "linux compat vulns (part 1)" by Ben Hawkes [article] [CVE-2010-3081]
2010: "linux compat vulns (part 2)" by Ben Hawkes [article] [CVE-2010-3301]
2010: "Some Notes on CVE-2010-3081 Exploitability" [article] [CVE-2010-3081]
2010: "Anatomy of an exploit: CVE-2010-3081" [article] [CVE-2010-3081]
2010: "CVE-2010-4258: Turning denial-of-service into privilege escalation" by Nelson Elhage [article] [CVE-2010-4258]
2009: "Linux NULL pointer dereference due to incorrect proto_ops initializations (CVE-2009-2692)" [article] [CVE-2009-2692]
2009: "Even when one byte matters" [article] [CVE-2009-1046]
2009: "CVE-2008-0009/CVE-2008-0010: Linux kernel vmsplice(2) Privilege Escalation" [article] [CVE-2008-0009, CVE-2008-0010]
2008: "vmsplice(): the making of a local root exploit" by Jonathan Corbet [article] [CVE-2008-0600]
2004: "Linux kernel do_mremap VMA limit local privilege escalation vulnerability" [article] [CVE-2004-0077]
2026: "From breaking into my ISP router to finding a MediaTek kernel 0day" by Victor Fresco [article] [CVE-2025-13942] [CVE-2025-13943] [CVE-2026-20452]
2025: "Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days" by William Liu [article] [CVE-2023-52440] [CVE-2023-4130]
2024: "Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap" by Robert Herrera and Alex Plaskett [article] [slides] [video] [CVE-2023-50809] [CVE-2024-20018]
2023: "Abusing Linux In-Kernel SMB Server to Gain Kernel Remote Code Execution" by Guillaume Teissier and Quentin Minster [video] [CVE-2022-47943] [CVE-2023-2593]
2022: "Writing a Linux Kernel Remote in 2022" by Samuel Page [article] [slides] [CVE-2022-0435]
2022: "Zenith: Pwn2Own TP-Link AC1750 Smart Wi-Fi Router Remote Code Execution Vulnerability" by Axel Souchet [article] [CVE-2022-24354]
2021: "BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution" by Andy Nguyen: BadChoice, BadKarma, BadVibes [article] [CVE-2020-12352, CVE-2020-12351, CVE-2020-24490]
2017: "Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2)" by Gal Beniamini [article] [CVE-2017-0569]
2017: "BlueBorn: The dangers of Bluetooth implementations: Unveiling zero day vulnerabilities and security flaws in modern Bluetooth stacks" [paper] [CVE-2017-1000251]
2016: "CVE Publication: CVE 2016-8633" by Eyal Itkin [article] [CVE-2016-8633]
2011: "Owned Over Amateur Radio: Remote Kernel Exploitation in 2011" at DEF CON [slides] [video] [CVE-2011-1493]
2009: "When a "potential D.o.S." means a one-shot remote kernel exploit: the SCTP story" [article] [CVE-2009-0065]
2026: "Januscape: Guest-to-Host Escape in KVM/x86" by Hyunwoo Kim [article] [CVE-2026-53359]
2026: "Bounding against the wrong buffer: an OOB read/write in KVM SEV-SNP (CVE-2026-53360)" by Stan Shaw [article] [CVE-2026-53360]
2026: "ITScape: Guest-to-Host Escape in KVM/arm64" by Hyunwoo Kim [article] [CVE-2026-46316]
2026: "When the bug is real but the path isn't: ITScape (CVE-2026-46316) and the case for minimal runtimes" by Anastassios Nanos [article] [CVE-2026-46316]
2021: "An EPYC escape: Case-study of a KVM breakout" by Felix Wilhelm [article] [CVE-2021-29657]
2026: "futex: remove_waiter stack uaf" by Guy Beck [article] [CVE-UNKNOWN]
2026: "The futex READ_ONCE" by Guy Beck [article] [CVE-UNKNOWN]
2026: "The epoll uaf" by Guy Beck [article] [CVE-UNKNOWN]
2026: "Unix GC Remastered" by Moe Acherir [article] [CVE-2025-40214]
2026: "Discovery & Validation in the Linux Kernel (Part 1): CAN Use-After-Free Race" by Samuel Page [article]
2026: "Discovery & Validation in the Linux Kernel (Part 2): FUSE Page Cache Overflow" by Samuel Page [article]
2026: "My First CVE - CVE-2026-23275 - io uring resize and taskrun race condition" [article] [CVE-2026-23275]
2026: "TTLM Parsing in WiFi/mac8021 one‑byte look past (over-the-air)" by Ruikai Peng [article] [CVE-UNKNOWN]
2025: "Glitching Google's TV Streamer From Adb To Root" by Niek Timmers [slides] [video] [NO-CVE]
2025: "mediatek? more like media-rekt, amirite." by hypr [article]
2025: "Dissecting a 1-Day Vulnerability in Linux's XFRM Subsystem" by Shreyas Penkar [article] [CVE-2025-39965] [trigger]
2025: "A Quick Note on CVE-2025-38617" by Pumpkin Chang [article] [CVE-2025-38617]
2025: "Fast & Faulty - A Use After Free in KGSL Fault Handling" by Shreyas Penkar [article] [CVE-2024-38399]
2025: "Race Against Time in the Kernel’s Clockwork" by Shreyas Penkar [article] [CVE-2025-38352]
2025: "Analysis of CVE-2025-37756, an UAF Vulnerability in Linux KTLS" by Pumpkin Chang [article] [CVE-2025-37756]
2025: "ZDI-25-310: Remote NULL Deref in Linux KSMBD" by Slava Moskvin [article] [CVE-2025-22037]
2025: "CVE-2024-36904 - Use-after-free vulnerability in the TCP subsystem of the Linux kernel" [article] [CVE-2024-36904]
2025: "Simply Analyzing Two N_GSM Vulnerabilities" by Pumpkin Chang [article] [CVE-2024-36016]
2025: "A Quick Note On Two mempolicy Vulnerabilities" by Pumpkin Chang [article] [CVE-2022-49080] [CVE-2023-4611]
2025: "The Evolution of Dirty COW" by Pumpkin Chang [article] [part 2] [CVE-2016-5195] [CVE-2017-1000405] [CVE-2022-2590]
2025: "A Quick Note on CVE-2024-53104" by Pumpkin Chang [article] [CVE-2024-53104]
2025: "A Series of io_uring pbuf Vulnerabilities" by Pumpkin Chang [article] [CVE-2024-0582] [CVE-2024-35880] [CVE-UNKNOWN]
2025: The io_uring Promotion in kernelCTF And Two Vulnerabilities Analysis [article] [CVE-UNKNOWN] [CVE-2023-52926]
2025: "Linux Kernel Some Vsock Vulnerabilities Analysis" by Pumpkin Chang [article] [CVE-2025-21669] [CVE-2025-21670] [CVE-2025-21666]
2025: "From Zero to Emo – My Journey of Many Failures in kernelCTF" by Pumpkin Chang [article] [CVE-2024-56770] [CVE-2025-21703] [CVE-2025-21700]
2025: "A 1-day a Day in the Lunar New Year" by Pumpkin Chang [article] [CVE-UNKNOWN]
2025: "Memory-related CVEs Exploited in kernelCTF" by Pumpkin Chang [article] [CVE-2024-50066] [CVE-2023-3269]
2025: "Two Network-related vunlnerabilities Analysis" by Pumpkin Chang [article] [CVE-2023-6932] [CVE-2023-0461]
2025: "Cellebrite zero-day exploit used to target phone of Serbian student activist" [article] [CVE-2024-53104] [CVE-2024-53197] [CVE-2024-50302] [note 1] [note 2] [note 3] [note 4] [note 5] [note 6] [note 7]
2025: "Accidentally uncovering a seven years old vulnerability in the Linux kernel" by Anderson Nascimento [article] [CVE-2024-36904]
2025: "Linux Kernel: Out of bounds Write in ksmbd_vfs_stream_write" by Jordy Zomer [article] [CVE-2024-56626]
2025: "Linux Kernel: Out of bounds Read in ksmbd_vfs_stream_read" by Jordy Zomer [article] [CVE-2024-56627]
2025: "Linux Kernel: Integer Overflow in eBPF XSK map_delete_elem Leads to Out-of-Bounds" by Jordy Zomer [article] [CVE-2024-56614]
2025: "Integer Overflow in eBPF DEVMAP map_delete_elem Leads to Out-of-Bounds" by Jordy Zomer [article] [CVE-2024-56615]
2025: "Some Casual Notes for CVE-2024-26921" by Pumpkin Chang [article] [CVE-2024-26921]
2024: "Linux Kernel ICMPv6 & CVE-2023-6200" by Pumpkin Chang [article] [CVE-2023-6200]
2024: "Linux Kernel Perf CVE-2023-5717 Quick Analysis" by Pumpkin Chang [article] [CVE-2023-5717]
2024: "A Quick Note for Perf CVE-2024-46713" by Pumpkin Chang [article] [CVE-2024-46713]
2024: "Linux Kernel Perf CVE-2023-6931 Analysis" by Pumpkin Chang [article] [CVE-2023-6931]
2024: "Linux Kernel Vsock 1-day Analysis" by Pumpkin Chang [article] [CVE-UNKNOWN]
2024: "Three Linux net/sched 1-day Analysis" by Pumpkin Chang [article] [CVE-2024-36974] [CVE-2023-0590]
2024: "Two Linux net/sched 1-day Analysis" by Pumpkin Chang [article] [CVE-2024-36978]
2024: "CVE-2024-41010 - Linux net/sched UAF 1-day Analysis" by Pumpkin Chang [article] [CVE-2024-41010]
2024: "Linux eBPF Design and Vulnerability Case Study" by Pumpkin Chang [article] [part 2] [CVE-2024-41009] [CVE-2022-23222] [CVE-2023-52447]
2024: "Linux Kernel: TOCTOU in Exec System" by Marco Vanotti [article] [CVE-2024-43882]
2024: "CVE-2024-26926 Analysis" by Maher Azzouzi [article] [CVE-2024-26926]
2024: "CVE-2024-44068: Samsung m2m1shot_scaler0 device driver page use-after-free in Android" [article] [CVE-2024-44068]
2024: "Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)" [article] [CVE-2024-27394]
2024: "ZDI-24-821: A Remote UAF in The Kernel's net/tipc" by Sam Page [article] [ZDI-24-821] [CVE-2024-36886]
2024: "Race condition in 9p file system" [article]
2024: "Notes about ZDI-24-195 in ksmbd" [thread] [ZDI-24-195]
2024: "PowerVR GPU - GPU Firmware may overwrite arbitrary kernel pages by RGXCreateFreeList" [report]
2024: "PowerVR GPU - UAF race conditon by DevmemIntPFNotify and DevmemIntCtxRelease" [report]
2023: "Ubuntu Shiftfs: Unbalanced Unlock Exploitation Attempt" by Jean-Baptiste Cayrou [slides] [CVE-2023-2612]
2023: "Attacking NPUs of Multiple Platforms" [slides] [CVE-2022-22265] [CVE-2020-28343] [SVE-2021-20204] [CVE-2023-42483] [CVE-2023-45864]
2023: "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023" by Alisa Esage [article] [CVE-2023-33063] [CVE-2023-33106] [CVE-2023-33107] [CVE-2022-22071] [CVE-2023-4211]
2023: "Unleashing ksmbd: remote exploitation of the Linux kernel (ZDI-23-979, ZDI-23-980)" by notselwyn [article] [CVE-2023-3866] [CVE-2023-3865] [exploits]
2023: "CVE-2023-4273: a vulnerability in the Linux exFAT driver" by Maxim Suhanov [article] [CVE-2023-4273]
2023: "Linux IPv6 'Route of Death' 0day" by Max VA [article] [CVE-2023-2156]
2022: "Linux Kernel: Infoleak in Bluetooth L2CAP Handling" [advisory] [CVE-2022-42895]
2022: "Linux Kernel: UAF in Bluetooth L2CAP Handshake" [advisory] [CVE-2022-42896]
2022: "Vulnerability Details for CVE-2022-41218" [article] [CVE-2022-41218]
2022: "Racing Cats to the Exit: A Boring Linux Kernel Use-After-Free" [article]
2022: "Android Universal Root: Exploiting xPU Drivers" [slides] [CVE-2022-20122] [CVE-2021-39815]
2022: "The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)" by Xingyu Jin [article] [CVE-2021-0920]
2022: "Finding bugs in the Linux Kernel Bluetooth Subsystem" by Itay Iellin [article] [part 2]
