与 Linux 内核安全及利用相关的链接集合。
每两个月更新一次。也欢迎提交 Pull Request。
关注 X 上的 @andreyknvl、Mastodon 上的 @[email protected] 或 Bluesky 上的 @andreyknvl 以获取更新通知。
订阅 Telegram 上的 @linkersec、X、Mastodon、Bluesky 或 Reddit 以获取精选内容。
2014：《Android Hacker's Handbook》作者：Joshua J. Drake [书籍]
2012：《A Guide to Kernel Exploitation: Attacking the Core》作者：Enrico Perla 和 Massimiliano Oldani [书籍] [资料]
2026："Kernel-Exploit-Dojo" [代码]
2026："Kernel-Hack-Drill Masterclass" by Alexander Popov [视频]
2026："PhantomMap: GPU-Assisted Kernel Exploitation" by Jiayi Hu et. al [论文] [幻灯片] [视频]
2026："Some notes on the security properties of the pipe_buffer kernel object" by Alexander Popov [文章]
2026："Cross-Cache Attacks for the Linux Kernel via PCP Massaging" by Claudio Migliorelli et. al [论文]
2026："Improving Linux Heap Exploit Reliability with FreshSlices and CPU-Bullying" [文章]
2026："DIRTYFREE: Simplified Data-Oriented Programming in the Linux Kernel" [论文]
2026："Table Manners: Diving into Linux pagetables exp techniques" by Lau [幻灯片]
2025："CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel" by Dong-ok Kim et. al [论文]
2025："Extending Kernel Race Windows Using '/dev/shm'" by Faith [文章]
2025："Linux Kernel Exploitation for Beginners" by Kevin Massey [幻灯片] [视频]
2025："KernelGP: Racing Against the Android Kernel" by Chariton Karamitas [视频]
2025："Control Flow Hijacking in the Linux Kernel" by Valeriy Yashnikov [幻灯片] [视频]
2025："Kernel Exploitation Techniques: Turning The (Page) Tables" by Samuel Page [文章]
2025："Linux Kernel Exploitation series" by r1ru [文章] [代码]
2025："Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch" [文章]
2025："WHEN GOOD KERNEL DEFENSES GO BAD: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks" by Lukas Maar et al. [论文] [成果] [GitHub]
2025："Cross Cache Attack CheetSheet" by Pumpkin Chang [文章]
2024："Cross Cache for Lazy People -- The Padding Spray Method" [文章]
2024："Linux Kernel Use Pipe Object to Do Data-Only Attack" by Pumpkin Chang [文章]
2024："CTF-style Tricks of Linux Kernel Exploitation" by Pumpkin Chang [文章] [第二部分]
2024："Linux Kernel exploitation cheatsheet" by Pumpkin Chang [文章]
2024："SLUB Internals for Exploit Developers" by Andrey Konovalov [幻灯片] [视频]
2024："PageJack: A Powerful Exploit Technique With Page-Level UAF" by Zhiyun Qian et. al [幻灯片] [视频] [代码] [总结]
2024："Linux Kernel Exploitation - ret2usr" by Sascha Schirra [文章]
2024："Binary Exploitation Notes: Kernel" by Andrej Ljubic [文章]
2024："Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation" [论文]
2024："GhostRace: Exploiting and Mitigating Speculative Race Conditions" [论文]
2024："Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems" [论文]
2023："Deep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernel" by Yudai Fujiwara [幻灯片] [视频]
2023："D^ 3CTF2023 d3kcache: From null-byte cross-cache overflow to infinite arbitrary read & write." [文章]
2023："No Tux Given: Diving Into Contemporary Linux Kernel Exploitation" by sam4k [幻灯片]
2023："Linux Kernel Exploitation series" by santaclz [文章] [第二部分] [第三部分]
2023："RetSpill: Igniting User-Controlled Data to Burn Away Linux Kernel Protections" [论文]
2023："Understanding Dirty Pagetable - m0leCon Finals 2023 CTF Writeup" [文章]
2023："Abusing RCU callbacks with a Use-After-Free read to defeat KASLR" [文章]
2023："Evils in the Sparse Texture Memory: Exploit Kernel Based on Undefined Behaviors of Graphic APIs" [幻灯片] [摘要]
2023："Make KSMA Great Again: The Art of Rooting Android devices by GPU MMU features" by Yong Wang [视频] [幻灯片]
2023："A new method for container escape using file-based DirtyCred" by Choo Yi Kai [文章]
2023："prctl anon_vma_name: An Amusing Linux Kernel Heap Spray" by Cherie-Anne Lee [文章]
2023："Dirty Pagetable: A Novel Exploitation Technique To Rule Linux Kernel" by Nicolas Wu [文章]
2023："Exploit Engineering – Attacking the Linux Kernel" by Alex Plaskett and Cedric Halbronn [幻灯片] [视频]
2023："Algorithmic Heap Layout Manipulation in the Linux Kernel" by Max Ufer and Daniel Baier [论文] [成果]
2023："The Return of Stack Overflows in the Linux Kernel" by Davide Ornaghi [幻灯片] [视频]
2023："Exploiting null-dereferences in the Linux kernel" by Seth Jenkins [文章]
2023："PSPRAY: Timing Side-Channel based Linux Kernel Heap Exploitation Technique" [论文] [视频]
2023："Linux Kernel PWN | 06 DirtyCred" [文章]
2023："Linux Kernel PWN | 05 ret2dir" [文章]
2022："Ret2page: The Art of Exploiting Use-After-Free Vulnerabilities in the Dedicated Cache" [幻灯片] [视频]
2022："Devils Are in the File Descriptors: It Is Time To Catch Them All" by Le Wu [幻灯片] [视频]
2022："FUSE for Linux Exploitation 101" [文章]
2022："Kernel Exploit Recipes" [手册]
2022："pipe_buffer arbitrary read write" by Jayden R [文章]
2022："Joy of exploiting the Kernel" [幻灯片]
2022："An exploit primitive in the Linux kernel inspired by DirtyPipe" [文章]
2022："DirtyCred: Escalating Privilege in Linux Kernel" [论文] [幻灯片] [成果]
2022："DirtyCred: Cautious! A New Exploitation Method! No Pipe but as Nasty as Dirty Pipe" [幻灯片] [成果]
2022："USMA: Share Kernel Code With Me" by Yong Liu, Jun Yao, and Xiaodong Wang [幻灯片] [视频] [论文] [文章]
2022："Linux kernel heap feng shui in 2022" by Michael S and Vitaly Nikolenko [文章]
2022："LiKE: A Series on Linux Kernel Exploitation" by sam4k [文章] [modprobe_path]
2022："Racing against the clock -- hitting a tiny kernel race window" by Jann Horn [文章]
2022："Playing for K(H)eaps: Understanding and Improving Linux Kernel Exploit Reliability" [论文] [成果]
2022："Learning Linux kernel exploitation" by 0x434b [文章] [第二部分]
2021："ExpRace: Exploiting Kernel Races through Raising Interrupts" at USENIX [论文] [幻灯片] [视频]
2021："Utilizing msg_msg Objects for Arbitrary Read and Arbitrary Write in the Linux Kernel" [文章] [第二部分]
2021："Linux Kernel Exploitation Technique: Overwriting modprobe_path" [文章]
2021："Learning Linux Kernel Exploitation" [文章] [第二部分] [第三部分]
2020："PTMA (Page Table Manipulation Attack): Attacking the core of memory permission" [幻灯片]
2020："Exploiting Kernel Races Through Taming Thread Interleaving" [幻灯片] [视频]
2020："Locating the kernel PGD on Android/aarch64" by Vitaly Nikolenko [文章]
2020："A Systematic Study of Elastic Objects in Kernel Exploitation" [论文] [视频]
2020："Exploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers" [幻灯片] [论文] [视频]
2020："BlindSide: Speculative Probing: Hacking Blind in the Spectre Era" [论文]
2020："Linux Kernel Stack Smashing" by Silvio Cesare [文章]
2020："Structures that can be used in kernel exploits" [文章]
2019："The Route to Root: Container Escape Using Kernel Exploitation" by Nimrod Stoler [文章]
2019："Linux Kernel: the ROP Exploit of Stack Overflow in Android Kernel" [文章]
2019："Hands Off and Putting SLAB/SLUB Feng Shui in Blackbox" by Yueqi (Lewis) Chen at Black Hat Europe [幻灯片] [代码]
2019："SLAKE: Facilitating Slab Manipulation for Exploiting Vulnerabilities in the Linux Kernel" by Yueqi (Lewis) Chen and Xinyu Xing [幻灯片] [论文]
2019："Exploiting Race Conditions Using the Scheduler" by Jann Horn at Linux Security Summit EU [幻灯片] [视频]
2019："Kepler: Facilitating Control-flow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities" [幻灯片] [视频] [论文]2019: "利用Linux内核中未初始化的使用泄露内核指针" by Jinbum Park [slides]
2019: "内核IDT权限提升" [article]
2018: "FUZE：面向促进内核释放后重用漏洞的漏洞利用生成" [slides] [paper]
2018: "Linux内核通用堆喷射" by Vitaly Nikolenko [article]
2018: "Linux内核漏洞利用中的栈崩溃" [article]
2018: "进入上帝模式 - 内核空间镜像攻击" [article]
2018: "镜像镜像：利用内核空间镜像攻击Root Android 8" by Wang Yong at HitB [slides]
2018: "KSMA：利用ARM MMU特性突破Android内核隔离并Root" by Wang Yong at BlackHat [slides]
2018: "仍然可锤击且可利用：关于仅软件物理内核隔离的有效性" [paper]
2018: "linux内核pwn笔记" [article]
2018: "在Linux内核漏洞利用中使用timer_list结构" [article]
2018: "进入上帝模式——内核空间镜像攻击" [article]
2017: "利用故障注入在Linux中提升权限" by Niek Timmers and Cristofaro Mune [slides] [video] [paper]
2017: "内核驱动mmap处理器漏洞利用" by Mateusz Fruba [paper]
2017: "Linux内核addr_limit漏洞/利用" by Vitaly Nikolenko [video]
2017: "栈冲突" by Qualys Research Team [article]
2017: "新的可靠Android内核Root利用技术" [slides]
2017: "利用定向栈喷射释放Linux内核中的使用前未初始化漏洞" [paper]
2017: "利用perf突破KASLR" by Lizzie Dixon [article]
2017: "Linux内核漏洞利用速查表" [article]
2016: "物理化：极端滥用基于Intel的分页系统" by Nicolas Economou and Enrique Nissim [slides]
2016: "Linux内核ROP——ROP之路（第1部分）" by Vitaly Nikolenko [article] [exercise]
2016: "Linux内核ROP——ROP之路（第2部分）" by Vitaly Nikolenko [article]
2016: "利用Linux内核中的COF漏洞" by Vitaly Nikolenko at Ruxcon [slides]
2016: "使用userfaultfd" by Lizzie Dixon [article]
2016: "直接内存攻击内核" by Ulf Frisk at DEF CON [video]
2016: "随机化无法阻止BPF JIT喷射" by Elena Reshetova at Black Hat [slides] [video] [paper]
2015: "内核数据攻击是一种现实的安全威胁" [paper]
2015: "从碰撞到利用：释放Linux内核中的释放后重用漏洞" [paper]
2015: "现代二进制漏洞利用：Linux内核漏洞利用" by Patrick Biernat [slides] [exercise]
2013: "像电影一样黑客：可视化页表进行本地漏洞利用" at Black Hat
2013: "利用Linux内核堆腐败" by Mohamed Channam [article]
2012: "编写内核漏洞利用" by Keegan McAllister [slides]
2012: "理解Linux内核漏洞" by Richard Carback [slides]
2012: "一堆麻烦：突破Linux内核SLOB分配器" by Dan Rosenberg [paper]
2012: "利用内核JIT喷射攻击加固的Linux系统" by Keegan McAllister [article] [code 1] [code 2]
2012: "从漏洞利用角度看Linux内核内存分配器" by Patroklos Argyroudis [article]
2012: "栈回来了" by Jon Oberheide [slides]
2012: "栈劫持" by Jon Oberheide and Dan Rosenberg [slides]
2011: "栈劫持之路：绕过grsec/PaX" by Jon Oberheide [article]
2010: "NULL大作战：利用内核空指针解引用" [article]
2010: "利用Linux内核中的栈溢出" by Jon Oberheide [article]
2010: "Linux内核漏洞利用：一次一个漏洞赢得Pwnie奖" by Jon Oberheide at SOURCE Boston [slides]
2009: "ring0有派对，你被邀请了" by Tavis Ormandy and Julien Tinnes at CanSecWest [slides]
2007: "内核模式漏洞利用入门" by Sylvester Keil and Clemens Kolbitsch [paper]
2007: "攻击核心：内核漏洞利用笔记" [article]
2007: "如何利用kmalloc()溢出" [article]
2007: "Linux 2.6内核漏洞利用" by Stephane Duverger [slides]
2005: "大内存管理漏洞" by Gael Delalleau at CanSecWest [slides]
2005: "如何利用kmalloc()溢出的故事" [article]
2026: "重新审视控制流劫持后的两步内核Shellcode执行" by Jennifer Miller [article]
2025: "不费吹灰之力击败KASLR" by Seth Jenkins [article]
2025: "绕过Ubuntu非特权命名空间限制之旅" by Pumpkin Chang [article]
2025: "通过WARN()探索内核地址泄露" by Pumpkin Chang [article]
2025: "Ubuntu非特权用户命名空间限制的三个绕过方法" [article]
2025: "FineIBT保护中的一个漏洞" by Jonathan Corbet [article]
2024: "SELinux绕过" [article]
2024: "面向页面编程：利用不可写代码页颠覆商用操作系统内核的控制流完整性" by Seunghun Han et al. [paper] [slides] [video]
2024: "深度缺陷：分析Android内核中针对单日利用的有效防御的集成" by Lukas Maar et. al [paper] [artifacts]
2024: "利用标记TLB从客户虚拟机泄露宿主机KASLR" by Reno Robert [article]
2024: "TikTag：利用推测执行突破ARM内存标签扩展" by Juhee Kim et al. [paper] [code]
2023: "更详细地观察空闲列表加固" by Matt Yurkewych [article] [slides]
2023: "Leaky Address Masking：利用非规范地址转换中的未屏蔽Spectre gadgets" [paper]
2023: "MTE实现，第3部分：内核" by Mark Brand [article]
2023: "利用面向页面编程突破硬件辅助内核控制流完整性" by Seunghun Han [slides]
2023: "EPF：邪恶数据包过滤器" by Di Jin, Vaggelis Atlidakis, and Vasileios P. Kemerlis [paper]
2023: "利用init_module绕过SELinux" by Sean Pesce [article]
2023: "使用静态分析工具寻找CPU侧信道gadgets" by Jordy Zomer and Alexandra Sandulescu [article]
2023: "Linux内核：Spectre-v1 gadgets" by Jordy Zomer and Alexandra Sandulescu [article]
2023: "Linux内核：Spectre v2 SMT缓解问题" by Eduardo Vela [article]
2022: "一段肮脏的小历史：绕过Spectre硬件防御泄露内核数据" [slides]
2022: "Tetragone：安全基础一课" by Pawel Wieczorkiewicz and Brad Spengler [article]
2021: "在IOMMU存在的情况下，DMA代码注入漏洞的特征化、利用与检测" [paper]
2021: "一种绕过许多内核保护的通用方法及其缓解措施" by Yueqi Chen [slides] [video]
2021: "攻击三星RKP" by Alexandre Adamski [article]
2020: "使用IOMMU时不应做的事" by Ilja van Sprundel and Joseph Tartaro [video]
2020: "三星S20设备上的SELinux RKP配置错误" by Vitaly Nikolenko [article]
2020: "TagBleed：利用标记TLB在隔离内核地址空间上突破KASLR" [paper]
2020: "Linux内核堆加固的弱点" by Silvio Cesare [article]
2020: "Linux内核堆加固分析" by Silvio Cesare [article]
2020: "PAN：又一个被攻破的缓解措施" by Siguza [article]
2019: "KNOX内核缓解绕过" by Dong-Hoon You at PoC [slides]
2017: "抬升(超级)监视器：绕过三星实时内核保护" by Gal Beniamini [article]
2016: "Linux内核x86-64绕过SMEP - KASLR - kptr_restrict" [article]
2016: "Linux上实用的SMEP绕过技术" by Vitaly Nikolenko at KIWICON [slides]
2016: "针对KASLR的微架构攻击" by Anders Fogh" [article]
2016: "跳跃绕过ASLR：攻击分支预测器绕过ASLR" by Dmitry Evtyushkin, Dmitry Ponomarev and Nael Abu-Ghazaleh [slides]
2016: "利用未文档化的CPU行为查看内核模式并在此过程中突破KASLR" at Black Hat [video]
2016: "利用Intel TSX突破KASLR" Yeongjin Jang, Sangho Lee and Taesoo Kim at Black Hat [slides] [video]
2016: "利用微架构突破KASLR" by Anders Fogh [article]
2015: "有效绕过Android上的kptr_restrict" by Gal Beniamini [article]
2014: "ret2dir：解构内核隔离" by Vasileios P. Kemerlis, Michalis Polychronakis and Angelos D. Keromytis at Black Hat Europe [paper] [video]
2013: "Linux内存技巧" by Dan Rosenberg [article]
2011: "SMEP：它是什么，以及如何在Linux上击败它" by Dan Rosenberg [article]
2009: "绕过Linux的空指针解引用利用防护（mmap_min_addr）" [article]
Google kernelCTF writeups and exploits
Assorted advisories by Gyorgy Miru and kutyacica
2026: "从KernelSnitch到实用的msg_msg/pipe_buffer堆KASLR泄露" by Lukas Maar [article] [code]
2025: "Linux内核CAN BCM协议中/proc组件的漏洞" by Anderson Nascimento [slides] [CVE-2023-52922] [CVE-2025-38003] [CVE-2025-38004]
2025: "CAN BCM子系统中的释放后重用导致信息泄露（CVE-2023-52922）" [article] [CVE-2023-52922]
2025: "KernelSnitch：针对内核数据结构的侧信道攻击" by Lukas Maar et al. [paper] [slides]
2024: "Linux vDSO与VVAR" by Pumpkin Chang [article] [CVE-2023-23586]
2024: "Linux内核中的CPU推测性漏洞与缓解" by Pumpkin Chang [article] [Spectre V1] [Spectre V2]
2024: "Linux内核Meltdown缓解分析" by Pumpkin Chang [article] [Meltdown]
2024: "离开内核，进入令牌" by Max Ammann and Emilio Lopez [article]
2023: "不存在的代码：意外读取Android设备内存" by Man Yue Mo [article] [CVE-2022-25664]
2023: "EntryBleed：Linux上针对KPTI的通用KASLR绕过" [paper] [CVE-2022-4543]
2022: "EntryBleed：利用预取在KPTI下突破KASLR（CVE-2022-4543）" [article] [CVE-2022-4543]
2022: "Netfilter中的又一个漏洞" by Arthur Mongodin [article] [CVE-2022-1972]2022: "AMD分支（错误）预测器：只需设置并忘记它！" by Pawel Wieczorkiewicz [article] [Spectre]
2022: "AMD分支（错误）预测器第二部分：前无CPU所及之处 (CVE-2021-26341)" by Pawel Wieczorkiewicz [article] [Spectre]
2021: "三星S10+/S9内核4.14（Android 10）内核函数地址（.text）和堆地址信息泄露" [article] [CVE-TBD]
2021: "Linux内核/proc/pid/syscall信息泄露漏洞" [article] [CVE-2020-28588]
2021: "“野外”中的Spectre漏洞利用" [article]
2021: "VDSO作为潜在的KASLR预言机" by Philip Pettersson and Alex Radocea [article]
2020: "PLATYPUS: 基于软件的x86功耗侧信道攻击" [paper]
2019: "CVE-2018-3639 / CVE-2019-7308 - Spectre攻击Linux内核ebpf的分析" [article] [CVE-2018-3639, CVE-2019-7308]
2019: "从IP ID到设备ID和KASLR绕过（扩展版）" [paper]
2018: "内核内存泄露与CANVAS第一部分 - Spectre：技巧与窍门" [article] [Spectre]
2018: "内核内存泄露与CANVAS第二部分 - CVE-2017-18344分析与利用笔记" [article] [CVE-2017-18344]
2018: "CVE-2017-18344: 利用Linux内核定时器子系统中的任意读漏洞" by Andrey Konovalov [article] [CVE-2017-18344]
2017: "Linux内核2.6.0至4.12-rc4中因ALSA定时器数据竞争导致的信息泄露" by Alexander Potapenko [announcement] [CVE-2017-1000380]
2017: "那场（几乎）不算的信息泄露" by Brad Spengler [article] [CVE-2017-7616]
2016: "利用Linux内核信息泄露绕过Linux kASLR" [article]
2010: "Linux内核pktcdvd内存泄露" by Jon Oberheide [article] [CVE-2010-3437]
2009: "Linux内核x86-64寄存器泄露" by Jon Oberheide [article] [CVE-2009-2910]
2009: "Linux内核getname()栈内存泄露" by Jon Oberheide [article] [CVE-2009-3001]
2026: "剖析与利用Linux LPE变体：DirtyClone (CVE-2026-43503)" by Eddy Tsalolikhin and Or Peles [article] [CVE-2026-43503]
2026: "隐藏19年以上，奖励$80,000+：报告谷歌kernelCTF的Linux内核零日漏洞 CVE-2026-43456" by Yuki Koike and Kota Toda [article] [CVE-2026-43456]
2026: "PACKET_EDIT_MEME.c (CVE-2026-46331)：又一个页缓存投毒噩梦" by Massimiliano Oldani [article] [exploit] [CVE-2026-46331]
2026: "IPV6_FRAG_ESCAPE：一个无特权容器/监狱逃逸PoC" by Massimiliano Oldani [article] [exploit] [CVE-UNKNOWN]
2026: "PTRACE_MAY_DREAM：CVE-2026-46333，遗忘得太早，包含完整权限提升" by Massimiliano Oldani [article] [exploit] [CVE-2026-46333]
2026: "CVE-2022-0995的分析与利用" by Felix [article] [CVE-2022-0995]
2026: "通过DRM GEM change_handle中的释放后使用实现无特权root权限 (CVE-2026-46215)" by Stan Shaw [article] [CVE-2026-46215]
2026: "通过FUSE readdir缓存中的越界写入实现无特权root权限 (CVE-2026-31694)" by Stan Shaw [article] [CVE-2026-31694]
2026: "Bad Epoll：Mythos遗漏的漏洞" by Jaeyoung Chung [article] [CVE-2026-46242]
2026: "通过页缓存利用CVE-2024-1065" by Kuzey Arda Bulut [article] [CVE-2024-1065]
2026: "Off By !：利用Linux内核中的释放后使用漏洞" by Oliver Sieber [article] [CVE-2026-23111]
2026: "CIFSwitch：一个非通用的Linux本地提权漏洞" by Asim Viladi Oglu Manizada [article] [exploit] [CVE-2026-46243]
2026: "Copy Fail" [summary] [article] [exploit] [CVE-2026-31431]
2026: "CVE-2026-31431：Copy Fail" by Jorge Buzeti [article] [CVE-2026-31431] [Copy Fail]
2026: "Copy Fail：一个4字节页缓存写入LPE" by Axura [article] [exploit] [CVE-2026-31431] [Copy Fail]
2026: "AF_ALG页缓存跨容器切换：第一部分" by Massimiliano Oldani [article] [exploit] [CVE-2026-31431] [Copy Fail]
2026: "Copy Fail：从Pod到主机" by Juno Im [article] [exploit] [CVE-2026-31431] [Copy Fail]
2026: "Dirty Frag" by Hyunwoo Kim [article] [exploit] [CVE-2026-43284] [CVE-2026-43500] [Dirty Frag]
2026: "copy fail 2：电动布加洛" by SiCk [article] [exploit] [CVE-2026-43284] [Dirty Frag]
2026: "发现并披露Linux内核权限提升漏洞家族‘Dirty Frag’中的RxGK变体" [article] [CVE-2026-43500] [Dirty Frag]
2026: "承载假设的负载：rxrpc案例 (CVE-2026-43500) 与从未存在的约束" by Massimiliano Oldani [article] [exploit] [CVE-2026-43500] [Dirty Frag]
2026: "Fragnesia" by William Bowling [article] [variant] [CVE-2026-46300] [Fragnesia]
2026: "DirtyCBC：当Linux内核在MAC之前解密将认证加密变成页缓存写入" by Kamil Leoniak [article] [CVE-UNKNOWN] [Dirty CBC] [Dirty Decrypt]
2026: "PinTheft" by Aaron Esau [article] [CVE-UNKNOWN]
2026: "从零到Root：攻击高通DSP驱动" by Xiling Gong [video] [CVE-2025-47394]
2026: "基于Tile的延迟Rooting：当你的GPU开始向内核代码空间渲染时！" by Xingyu Jin and Martijn Bogaard [slides] [video] [CVE-2025-25180]
2026: "通过高通AI加速器Linux内核驱动中的页释放后使用实现权限提升" by Lukas Maar [article] [code] [CVE-UNKNOWN]
2026: "Damned OOB" by Mohamed Salem Eddah [article] [CVE-UNKNOWN]
2026: "Linux内核__ptrace_may_access()函数中的逻辑漏洞" by Qualys Research Team [article] [CVE-2026-46333]
2026: "CVE-2026-31419：Linux绑定驱动中的释放后使用漏洞" by Moe Acherir [article] [CVE-2026-31419]
2026: "CVE-2024-0582，或轻松内核利用" by Moe Acherir [article] [CVE-2024-0582]
2026: "Pixel 10的零点击利用链" by Natalie Silvanovich and Seth Jenkins [video] [article] [CVE-UNKNOWN]
2026: "这个Android内核利用太简单了" by Billy Ellis [video] [CVE-UNKNOWN]
2026: "通过CVE-2025-21479探索Android ROOT" [article] [CVE-2025-21479]
2026: "Codex黑掉了三星电视" [article] [CVE-UNKNOWN]
2026: "从Netfilter漏洞到kernelCTF：利用Linux内核中的CVE-2026-23274并赢得$10500赏金" [article] [CVE-2026-23274]
2026: "重现CVE-2026-23111：一个字符如何改变一切" [article] [CVE-2026-23111]
2026: "评估Claude Mythos Preview的网络安全能力" [article] [CVE-2024-47711]
2026: "内核炼金术第一部分：利用CVE-2025-20741开发利用原语" by hypr [article] [CVE-2025-20741]
2026: "Out-of-Cancel：基于工作队列取消API的漏洞类别" [article] [CVE-2026-23239]
2026: "Linux内核CVE-2022-3910 (h0mbre kCTF漏洞) LPE" [article] [CVE-2022-3910]
2026: "CrackArmor：AppArmor中的多个漏洞" by Qualys Research Team [article] [CVE-UNKNOWN]
2026: "PageJack实战：CVE-2022-0995漏洞利用" by Jean Vincent [article] [CVE-2022-0995]
2026: "竞态中的竞态：利用Linux数据包套接字中的CVE-2025-38617" [article] [CVE-2025-38617]
2026: "Linux内核net/sched CAKE Qdisc释放后使用LPE" by Noamr [article] [CVE-UNKNOWN]
2026: "[Cryptodev-linux] 页面级UAF利用" by nasm [article] [NO-CVE]
2026: "Pixel 9的零点击利用链第二部分：用大波浪破解沙箱" by Seth Jenkins [article] [CVE-2025-36934]
2026: "Translator/Mali Utgard 黑客技术" [articles] [exploits] [CVE-UNKNOWN]
2025: "N天Android GPU驱动漏洞演练" by Angus [video] [CVE-2022-22706]
2025: "挑战MTE的故事：一次性Root启用了MTE的Google Pixel" by Yong Wang [slides] [CVE-UNKNOWN]
2025: "CVE-2025-38352 (第一部分) - 野外的Android内核漏洞分析 + PoC" by Faith [article] [CVE-2025-38352]
2025: "CVE-2025-38352 (第二部分) - 无需内核补丁即可扩展竞态窗口" by Faith [article] [CVE-2025-38352]
2025: "CVE-2025-38352 (第三部分) - 揭示Chronomaly" by Faith [article] exploit [CVE-2025-38352]
2025: "悬空指针、脆弱内存——从未公开漏洞到Pixel 9 Pro权限提升" [article] [CVE-2025-6349] [CVE-2025-8045]
2025: "Dirty Ptrace：利用内核mmap处理器中的未定义行为" by Xingyu Jin and Martijn Bogaard [slides] [video] [CVE-2024-44068] [CVE‑2025‑23244] [CVE-2025-8109] [CVE-2024-49739]
2025: "Linux io_uring中的即视感：经过多代修复后再次打破内存共享" by Pumpkin Chang [slides] [video] [CVE-2025-21836]
2025: "CUDA de Grâce" by Valentina Palmiotti and Samuel Lovejoy [slides] [video] [CVE-UNKNOWN]
2025: "红黑树家族剧：通过红黑树变换利用Linux内核零日漏洞" by Savino Dicanosa and William Liu [slides] [video] [CVE-2025-38001]
2025: "竞态条件交响曲：从微小的想法到Pwnie奖" by Hyunwoo Kim and Wongi Lee [slides] [CVE-2024-50264]
2025: "在三星S23上利用CVE-2025-21479" by XploitBengineer [article] [CVE-2025-21479]
2025: "通过Ubuntu内核af_unix中的引用计数不平衡实现LPE" by kylebot [article] [CVE-2025-13350]
2025: "破解Pixel 8：利用未公开的DSP绕过MTE" by Pan Zhenpeng & Jheng Bing Jhong [slides] [video]
2025: "DirtyPipe-CVE-2022-0847" by Abdul Qadir [article] [CVE-2022-0847]
2025: "哎呀！这是内核栈释放后使用：利用NVIDIA的GPU Linux驱动程序" by Robin Bastide [article] [CVE-2025-23280] [CVE-2025-23330]
2025: "ksmbd - 利用CVE-2025-37947" by Norbert Szetei [article] [CVE-2025-37947] [exploit]
2025: "分析Linux内核TLS子系统中的1天漏洞" by Faith [article] [CVE-2025-39946] [exploit]
2025: "分析Linux内核1天漏洞0aeb54ac" by Pumpkin Chang [article] [CVE-2025-39946]
2025: "Kernel-hack-drill以及利用Linux内核CVE-2024-50264的新方法" by Alexander Popov [article] [CVE-2024-50264]
2025: "Android物理内存漫游：CVE-2025-21479权限提升" [article] [comment] [CVE-2025-21479]
2025: "netfilter: ipset: 缺少范围检查LPE" [article] [CVE-2024-53141]
2025: "从Chrome渲染器代码执行到带MSG_OOB的内核" by Jann Horn [article] [CVE-2025-38236]
2025: "[CVE-2025-38001] 用零日漏洞攻破所有Google kernelCTF实例和Debian 12获得$82k：红黑树家族剧（第一部分：LTS和COS）" by D3vil [article] [CVE-2025-38001]
2025: "Linux内核Pipapo Set双重释放LPE" by Slavin and Le Premier Homme [article] [CVE-UNKNOWN]
2025: "Netfilter Tunnel的悲剧：CVE-2025-22056" [article] [CVE-2025-22056]
2025: "Solo：一个Pixel 6 Pro的故事（当一个漏洞就足够时）" by Lin Ze Wei [article] [CVE-2023-48409] [CVE-2023-26083]
2025: "用CVE-2025-0072绕过MTE" by Man Yue Mo [article] [CVE-2025-0072]
2025: "Skin in the Game：GPU IOMMU不规则损伤的生存之道" by Fish and Ling Hanqin [video] [CVE-2022-38181] [CVE-2023-6241] [CVE-2023-33107] [CVE-2024-23372] [CVE-2024-31333]
2025: "[CVE-2025-37752] 两字节的疯狂：用0x0000写入262636字节越界攻破Linux内核" by D3vil [article] [CVE-2025-37752]
2025: "Linux内核利用：CVE-2025-21756：Vsock的攻击" by Michael Hoefler [article] [CVE-2025-21756]
2025: "CVE-2025-21692 nday writeup" by volticks [article] [exploit] [CVE-2025-21756]
2025: "通过脏页表法利用CVE-2024-0582" by Kuzey Arda Bulut [article] [CVE-2024-0582]
2025: "Kernel-Hack-Drill：开发Linux内核漏洞利用的环境" by Alexander Popov [slides] [CVE-2024-50264]
2025: "Linux内核hfsplus slab越界写入" by Attila Szasz [article] slides [CVE-2025-0927]
2025: "CVE-2024-53141：Netfilter Ipset中的越界写入漏洞" by Pumpkin Chang [article] [CVE-2024-53141]2025: "修补 Google Container-Optimized OS 补丁缺口（$0 成本）" 作者：h0mbre [article] [CVE-UNKNOWN]
2025: "恶意意图：利用 GPU 漏洞（CVE-2022-22706 / CVE-2021-39793）" 作者：Ng Zhi Yang [article] [CVE-2022-22706] [CVE-2021-39793]
2025: "Android GPU 漏洞攻击与防御入门" [article] [CVE-2024-23380]
2024: "Qualcomm DSP 驱动——意外挖掘出一个漏洞利用" 作者：Seth Jenkins [article] video [CVE-2024-38402] [CVE-2024-21455] [CVE-2024-33060] [CVE-2024-49848] [CVE-2024-43047]
2024: "OtterRoot：Netfilter 通用 Root 1-day" 作者：Pedro Pinto [article] [CVE-2024-26809]
2024: "如何在 Pwn2Own Vancouver 2024 上使用一种新颖方法利用 Ubuntu 上的有限 OOB" 作者：Pumpkin Chang [slides] [CVE-UNKNOWN]
2024: "GPUAF——两种 Root 所有基于 Qualcomm 的 Android 手机的方法" 作者：Pan Zhenpeng 和 Jheng Bing Jhong [slides] [CVE-2024-23380] [CVE-2024-23373]
2024: "突破牢笼：通过 B-PUAF 获取 Android 通用 Root" 作者：Lu Yutao 和 Ling Hanqin [slides] [CVE-2024-46740]
2024: "释放 0day：能力迁移与征服 Linux 内核" 作者：Pedro Pinto [slides] [video] [CVE-2024-41010]
2024: "利用跨 CPU 分配来利用禁用抢占的 Linux 内核" 作者：Mingi Cho 和 Wongi Lee [slides] [CVE-2023-31248] [video] [CVE-2024-36978]
2024: "1day 漏洞开发：DirtyCOW" [video] [CVE-2016-5195]
2024: "Linux 内核 perf events 中的竞争条件" [code] [CVE-UNKNOWN]
2024: "CVE-2020-27786（竞争条件 + 释放后使用）" 作者：ii4gsp [article] [CVE-2020-27786]
2024: "GPUAF 使用通用 GPU 利用技术攻击 Pixel8" 作者：Pan Zhenpeng 和 Jheng Bing Jhong [slides] [video] [CVE-UNKNOWN]
2024: "Linux 内核 taprio OOB" [article] [CVE-2024-36974]
2024: "CVE-2022-22265 Samsung npu 驱动" 作者：Javier P Rufo [article] [CVE-2022-22265]
2024: "Android Root 之路：在智能手机上利用 GPU" 作者：Xiling Gong, Xuan Xing 和 Eugene Rodionov [slides] [video] [CVE-2024-23380]
2024: "冲突、燃烧与利用：操纵过滤器以攻陷 kernelCTF" 作者：HexRabbit [slides] [video] [CVE-2024-26925]
2024: "深入解析 CVE-2023-2163：我们如何发现并修复 eBPF Linux 内核漏洞" 作者：Juan Jose Lopez Jaimez 和 Meador Inge [article] [CVE-2023-2163]
2024: "eBPF 验证器寄存器限制跟踪中的漏洞" 作者：Juan Jose Lopez Jaimez [CVE-2024-41003]
2024: "Android Binder 攻击矩阵" 作者：Utkarsh [article] [part 2] [part 3] [part 4] [part 5]
2024: "驱动 Android 驱动向前" 作者：Seth Jenkins [article] [video] [CVE-2023-32837] [CVE-2023-32832]
2024: "攻击 Android Binder：CVE-2023-20938 分析与利用" 作者：Eugene Rodionov, Zi Fan Tan 和 Gulshan Singh [article] [CVE-2023-20938]
2024: "如何通过模糊测试获得 Android 通用 Root：攻击 Android Binder" 作者：Eugene Rodionov 和 Zi Fan Tan [slides] [video] [CVE-2023-20938]
2024: "Linux 内核 nft_validate_register_store 整数溢出权限提升" [article] [CVE-UNKNOWN]
2024: "跨缓存游戏：让我们以更有效的方式取胜！" 作者：Le Wu [slides] [video] [CVE-2023-21400]
2024: "LinkDoor：Android Netlink 内核模块中的隐藏攻击面" 作者：Chao Ma 等人 [slides] [CVE-2023-32878] [CVE-2023-32882]
2024: "翻页：分析 nf_tables 中的新 Linux 漏洞及加固利用技术" 作者：notselwyn [article] [exploit] [CVE-2024-1086]
2024: "64 字节与一条 ROP 链——遍历 nftables 之旅" 作者：Davide Ornaghi [article] [part 2] [exploit] [CVE-2023-0179]
2024: "关注补丁缺口：利用 Ubuntu 中的 io_uring 漏洞" 作者：Oriol Castejon [CVE-2024-0582]
2024: "CVE-2022-2586 分析报告" [article] [CVE-2022-2586]
2024: "n_gsm_exploit" [article]
2024: "一个 GSM 内核 LPE 的故事" [article] [exploit] [notes] [discussion]
2024: "在启用 MTE 的 Pixel 8 上获取内核代码执行" 作者：Man Yue Mo [article] [exploit] [CVE-2023-6241]
2024: "Mali GPU 内核 LPE：Pixel7/8 Pro 的 Android 14 内核漏洞利用" 作者：Mohamed Ghannam [article] [CVE-2023-26083]
2024: "CVE-2023-5178：在 Ubuntu 23.10 上利用 Linux 内核 NVMe-oF-TCP 驱动" 作者：rockrid3r [article] [CVE-2023-5178] [exploit]
2023: "利用空指针解引用" 作者：Seth Jenkins [slides] [CVE-UNKNOWN]
2023: "Linux 内核 GSM 多路复用竞争条件本地权限提升漏洞（CVE-2023-6546）" 作者：Nassim Asrir [CVE-2023-6546]
2023: "CVE-2022-27666：你的内存，我的文件" 作者：Erin Avllazagaj [article] [CVE-2022-27666]
2023: "通过 io_uring 征服内存——CVE-2023-2598 分析" [article] [exploit] [CVE-2023-2598]
2023: "征服 nf_tables 中的释放后使用漏洞：CVE-2022-32250 详细分析与利用" 作者：Yordan Stoychev [article] [CVE-2022-32250]
2023: "一石三鸟：用一个 1-day Linux 漏洞攻陷全部三个 Google kernelCTF 实例" [slides] [abstract] [CVE-2023-3390]
2023: "用 Zig 利用 Linux 内核中的一个漏洞" 作者：Richard Palethorpe [article] [video] [CVE-2023-0461]
2023: "通过纯数据利用逃逸 Google kCTF 容器" 作者：h0mbre [article] [CVE-2022-3910]
2023: "分析一个现代野外 Android 漏洞" 作者：Seth Jenkins [article] [CVE-2023-0266] [CVE-2023-26083]
2023: "老漏洞，浅漏洞：在 Pwn2Own Vancouver 2023 上利用 Ubuntu" 作者：Tanguy Dubroca [article] [CVE-2023-35001]
2023: "Linux 内核漏洞利用（CVE-2022–32250）结合 mqueue" [article] [CVE-2022-32250]
2023: "Bad io_uring：Android Root 的新纪元" 作者：Zhenpeng Lin [slides] [video] [CVE-2022-20409]
2023: "CVE-2023-3389 - LinkedPoll" 作者：Querijn Voet [article] [CVE-2023-3389]
2023: "GameOver(lay)：Ubuntu Linux 中易于利用的本地权限提升漏洞" 作者：Sagi Tzadik 和 Shir Tamari [article] [CVE-2023-2640] [CVE-2023-32629]
2023: "StackRot（CVE-2023-3269）：Linux 内核权限提升漏洞" 作者：Ruihan Li [article] [CVE-2023-3269]
2023: "此漏洞无 CVE。它从未进入官方内核" [article]
2023: "CVE-2020-27786 利用 userfaultfd + 修补文件结构等 passwd" [article] [CVE-2020-27786]
2023: "破解代码——利用与分析 cls_tcindex 分类器漏洞 CVE-2023-1829" 作者：Vu Thi Lan [article] [CVE-2023-1829]
2023: "CVE-2023-2008——分析并利用 udmabuf 驱动中的漏洞" [article] [CVE-2023-2008]
2023: "从根源 Root：寻找 Project Zero 漏洞的一个变种" 作者：Man Yue Mo [article] [CVE-2022-46395]
2023: "与锁竞速：利用 Android 内核中的自旋锁 UAF" 作者：Moshe Kol [article] [slides] [video] [exploit] [CVE-2022-20421]
2023: "一个 PoC 两个漏洞：从 Android 12 到 Android 13 的 Pixel 6 Root" 作者：Yong Wang [slides] [CVE-2021-28664]
2023: "OverlayFS 漏洞 CVE-2023-0386：概述、检测与修复" [article] [CVE-2023-0386]
2023: "利用遗留补丁攻陷 Pixel 6" 作者：Man Yue Mo [article] [GHSL-2023-005]
2023: "重访 CVE-2017-11176" 作者：Nils Ole Timm [article] [CVE-2017-11176]
2023: "Root FiiO M6" 作者：Jack Maginnes [article] [part 2] [video]
2023: "利用 CVE-2021-3490 实现容器逃逸" 作者：Karsten Kyonig [article] [CVE-2021-3490]
2023: "用一个非 Google 漏洞攻陷所有 Google 手机" [article] [CVE-2022-38181]
2023: "CVE-2023-0386 分析与利用" 作者：chenaotian [article] [CVE-2023-0386]
2022: "利用 Dirty Pipe 漏洞逃逸容器" 作者：Eric Mountain 等 [article] [CVE-2022-0847]
2022: "我们如何利用 Dirty Pipe 在 Android 模拟器和 Pixel 6 上获得反向 Root Shell" 作者：LiN 和 YingMuo [slides] [video] [CVE-2022-0847]
2022: "Linux 内核 io_uring 模块 pbuf_ring 漏洞与权限提升 0day" [article [CVE-UNKNOWN]
2022: "CVE-2022-1015：Netfilter 验证缺陷导致本地权限提升" 作者：Yordan Stoychev [article] [CVE-2022-1015]
2022: "CVE-2022-22265：Android 中 Samsung NPU 设备驱动双重释放" 作者：Xingyu Jin [article] [CVE-2022-22265]
2022: "Linux 内核：在 kmalloc-cg 中利用 Netfilter 释放后使用" 作者：Sergi Martinez [article] [CVE-2022-32250]
2022: "利用 CVE-2022-42703——重振栈攻击" 作者：Seth Jenkins [article] [CVE-2022-42703]
2022: "CVE-2022-2602：将 DirtyCred 文件利用应用于 io_uring UAF" [article] [CVE-2022-2602]
2022: "DirtyCred 重制版：如何将 UAF 转化为权限提升" [article] [CVE-2022-2602]
2022: "利用 Linux Netfilter 表（NFT）模块中的跨表对象引用" [slides] [CVE-2022-2078] [CVE-2022-2586]
2022: "Linux 内核 n-day 漏洞利用开发" [article] [CVE-2020-27786]
2022: "Linux 内核漏洞利用开发：1day 案例研究" 作者：Alessandro Groppo [article] [CVE-2020-27786]
2022: "[CVE-2022-1786] 破晓之旅" [article] [CVE-2022-1786]
2022: "一个非常强大的剪贴板：分析 Samsung 的野外漏洞利用链" 作者：Maddie Stone [article] [CVE-2021-25369] [CVE-2021-25370]
2022: "利用 Qualcomm TrustZone 攻击 Android 内核" 作者：Tamir Zahavi-Brunner [article] [video] [CVE-2021-1961]
2022: "NETLINK 殖民者：利用 nf_tables 中的有限 UAF（CVE-2022-32250）" [article] [slides] [video] [CVE-2022-32250]
2022: "Linux 内核漏洞利用（CVE-2022-32250）结合 mqueue" [article] [CVE-2022-32250]
2022: "CVE-2022-2586 的 N-day 漏洞利用：Linux 内核 nft_object UAF" 作者：Alejandro Guerrero [article] [CVE-2022-2586]
2022: "监控监控厂商：深入解析 2021 年野外 Android 完整链条" [slides] [CVE-2021-0920]
2022: "CVE-2022-29582：io_uring 漏洞" 作者：Awarau 和 David Bouman [article] [CVE-2022-29582]
2022: "Linux 内核 io_uring 模块 pbuf_ring 漏洞与权限提升 0day" [article]
2022: "在不进行内存破坏的情况下破坏内存" 作者：Man Yue Mo [article] [CVE-2022-20186]
2022: "[CVE-2022-34918] Linux 防火墙的裂缝" 作者：Arthur Mongodin [article] [CVE-2022-34918] [exploit]
2022: "CVE-2022-34918：netfilter 分析笔记" [article] [CVE-2022-34918]2022: "基于 USMA 的内核通用 EXP 编写思路在 CVE-2022-34918 上的实践" [文章] [CVE-2022-34918]
2022: "安卓内核缓解措施的障碍赛" 作者：Man Yue Mo [文章] [CVE-2022-22057]
2022: "io_uring——新代码、新漏洞和新的利用技术" 作者：Lam Jun Rong [文章] [CVE-2021-41073]
2022: "Dirty Pipe 漏洞探索 (CVE-2022-0847)" 作者：lolcads [文章] [CVE-2022-0847]
2022: "DirtyPipe-Android/TECHNICAL-DETAILS.md" 作者：polygraphene [文章] [CVE-2022-0847]
2022: "在 Android 上将 dirtypipe 武器化" 作者：Giovanni Rocca [幻灯片] [利用代码] [CVE-2022-0847]
2022: "形势逆转：对 nf_tables 中两个新 Linux 漏洞的分析" 作者：David Bouman [CVE-2022-1015] [CVE-2022-1016]
2022: "CVE-2022-25636 的发现与利用" 作者：Nick Gregory [文章] [CVE-2022-25636]
2022: "CVE-2022-27666：利用 Linux 内核中的 esp6 模块" 作者：ETenal [文章] [CVE-2022-27666]
2022: "Put an io_uring on it: 利用 Linux 内核" 作者：Valentina Palmiotti [文章] [CVE-2021-41073]
2022: "Dirty Pipe 漏洞" 作者：Max Kellermann [文章] [CVE-2022-0847]
2022: "CVE-2022-0185——攻破 Ubuntu 并逃逸 Google KCTF 容器后赢得 31337 美元赏金" [文章] [CVE-2022-0185]
2022: "CVE-2022-0185：Linux 内核 slab 越界写入：利用与分析" 作者：Alejandro Guerrero [文章] [CVE-2022-0185]
2022: "CVE-2022-0185：案例研究" [文章] [CVE-2022-0185]
2022: "CVE-2022-0185：分析和利用以及 pipe 新原语的思考与实践" [文章] [CVE-2022-0185]
2022: "Linux 内核释放后使用 (CVE-2021-23134) PoC" [文章] [CVE-2021-23134]
2022: "通过 ssh 利用 CVE-2021-26708 (Linux 内核)" [文章] [CVE-2021-26708]
2022: "利用 CVE-2019-2215" 作者：cutesmilee [文章] [CVE-2019-2215]
2022: "Linux 内核 PWN | 02 CVE-2009-1897" [文章] [CVE-2009-1897]
2021: "台风山竹：两个漏洞构成的单次点击远程通用 Root" [幻灯片] [视频] [CVE-2020-0423]
2021: "CVE-2021-28664 的分析与利用实现 Android 权限提升" 作者：Bernard Lampe [幻灯片] [CVE-2021-28664]
2021: "你的垃圾内核漏洞，我的珍贵 0day" 作者：Zhenpeng Lin [幻灯片] [CVE-2021-3715]
2021: "[CVE-2021-42008] 利用 Linux 6pack 驱动中一个 16 年历史的漏洞" [文章] [CVE-2021-42008]
2021: "PWN2OWN 本地权限提升类别，Ubuntu 桌面利用" [文章] [CVE-TBD]
2021: "逆向与利用三星 NPU" 作者：Maxime Peterlin [文章] [第二部分] 幻灯片
2021: "机器的坠落：利用高通 NPU（神经网络处理单元）内核驱动" 作者：Man Yue Mo [文章] [CVE-2021-1940, CVE-2021-1968, CVE-2021-1969]
2021: "利用 CVE-2021-43267" 作者：Blasty [文章] [CVE-2021-43267]
2021: "一个简单的 Linux 内核内存损坏漏洞如何导致系统完全沦陷" 作者：Jann Horn [文章] [CVE-TBD]
2021: "SuDump：通过内核利用 suid 二进制文件" 作者：Itai Greenhut [文章] [CVE-TBD]
2021: "CVE-2021-34866 Writeup" 作者：HexRabbit [文章] [CVE-2021-34866]
2021: "使用 eBPF 进行内核利用：一个爱情故事" 作者：Valentina Palmiotti [文章] [CVE-2021-3490]
2021: "通过 Android 内核中的 Ret2bpf 利用 UAF 的艺术" 作者：Xingyu Jin 和 Richard Neal [文章] [幻灯片] [视频] [CVE-2021-0399]
2021: "Android 内核后门漏洞内幕" [文章] [CVE-2021-28663]
2021: "从 Chrome 沙箱逃逸到 root" [文章] [CVE-2020-0423]
2021: "CVE-2017-11176" 作者：Maher Azzouzi [文章] [CVE-2017-11176]
2021: "Sequoia：Linux 文件系统层的深层 root (CVE-2021-33909)" 作者：Qualys 研究团队 [文章] [CVE-2021-33909]
2021: "CVE-2021-22555：将 \x00\x00 变成 10000 美元" 作者：Andy Nguyen [CVE-2021-22555, 文章]
2021: "利用 Ubuntu shiftfs 驱动中的双重释放漏洞 (CVE-2021-3492)" 作者：Vincent Dehors [文章] [CVE-2021-3492]
2021: "CVE-2021-20226：一个引用计数错误导致 io_uring 中的本地权限提升" [文章] [CVE-2021-20226]
2021: "CVE-2021-32606：CAN ISOTP 本地权限提升" [文章] [CVE-2021-32606]
2021: "CVE-2021-3609：CAN BCM 本地权限提升" [文章] [公告] [CVE-2021-3609]
2021: "蓝色华容道 (CVE-2021-3573) 及其修复故事" 作者：f0rm2l1n [文章] [公告] [CVE-2021-3573]
2021: "ZDI-20-1440：Linux 内核 eBPF 验证器中的一个错误计算漏洞" 作者：Lucas Leong [文章]
2021: "ZDI-20-1440 Writeup" 作者：HexRabbit [文章]
2021: "SSD 公告 – OverlayFS PE" [文章] [CVE-2021-3493]
2021: "[BugTales] 三星 NPU 驱动中的紧张漏洞碰撞" 作者：Gyorgy Miru [文章] [CVE-2020-28343, SVE-2020-18610]
2021: "CVE-2021-20226：Linux 内核 io_uring 子系统中的一个引用计数漏洞" 作者：Lucas Leong [文章] [CVE-2021-20226]
2021: "差一天就成完整链：第 1 部分 - Android 内核任意代码执行" 作者：Man Yue Mo [文章] [GHSL-2020-375]
2021: "Linux 内核中的新老漏洞" [文章] [CVE-2021-27365, CVE-2021-27363, CVE-2021-27364]
2021: "四字节的力量：利用 Linux 内核中的 CVE-2021-26708" [文章] [幻灯片] [视频] [CVE-2021-26708]
2021: "改进 Linux 内核中 CVE-2021-26708 的利用以绕过 LKRG" 作者：Alexander Popov [文章] [幻灯片] [视频]
2021: "使用 CVE-2021-26708 漏洞在 Linux 中获取 root 权限" 作者：Markel Azpeitia Loiti [论文]
2021: "CVE-2020-14381 的离奇案例" [文章] [CVE-2020-14381]
2021: "银河的熔毁——利用 SVE-2020-18610" [文章] [CVE-2020-28343, SVE-2020-18610]
2021: "野外系列：Android 利用" 作者：Mark Brand [文章]
2021: "利用 CVE-2014-3153 (Towelroot)" 作者：Elon Gliksberg [文章] [CVE-2014-3153]
2021: "CVE-2014-3153" 作者：Maher Azzouzi [文章] [CVE-2014-3153]
2020: "一位 iOS 黑客尝试 Android" 作者：Brandon Azad [文章] [CVE-2020-28343, SVE-2020-18610]
2020: "利用 Binder 中的单条指令竞态条件" [文章] [CVE-2020-0423]
2020: "Android 内核上的三朵乌云" 作者：Jun Yao [幻灯片] [CVE-2020-3680]
2020: "使用文件系统模糊器进行内核利用" [幻灯片] [视频] [CVE-2019-19377]
2020: "在一部旧 Android 手机中查找并利用一个漏洞 (LPE)" 作者：Brandon Falk [直播] [第二部分] [总结]
2020: "CVE-2020-14386：Linux 内核中的权限提升漏洞" 作者：Or Cohen [文章] [CVE-2020-14386]
2020: "攻击高通 Adreno GPU" 作者：Ben Hawkes [文章] [CVE-2020-11179]
2020: "TiYunZong：远程 Root 现代 Android 设备的利用链" 作者：龚广 (Black Hat) [幻灯片] [论文] [CVE-2019-10567]
2020: "Binder - CVE-2020-0041 的分析与利用" 作者：Jean-Baptiste Cayrou [文章] [CVE-2020-0041]
2020: "Binder IPC 及其漏洞" 作者：Jean-Baptiste Cayrou (THCON) [幻灯片] [CVE-2019-2215, CVE-2019-2025, CVE-2019-2181, CVE-2019-2214, CVE-2020-0041]
2020: "利用 CVE-2020-0041 - 第二部分：提权至 root" 作者：Eloi Sanfelix 和 Jordan Gruskovnjak [文章] [CVE-2020-0041]
2020: "一个漏洞碰撞的故事" 作者：Eloi Sanfelix (OffensiveCon) [幻灯片] [视频] [CVE-2019-2025]
2020: "CVE-2020-8835：因不当 eBPF 程序验证导致的 Linux 内核权限提升" 作者：Manfred Paul [文章] [CVE-2020-8835]
2020: "缓解措施本身也是攻击面" 作者：Jann Horn [文章]
2020: "CVE-2019-18683：利用 Linux 内核 V4L2 子系统中的漏洞" 作者：Alexander Popov [文章] [幻灯片] [CVE-2019-18683]
2020: "影响所有高通设备的多个内核漏洞" 作者：Tamir Zahavi-Brunner [文章] [CVE-2019-14040, CVE-2019-14041]
2019: "CVE-2017-16995 分析 - eBPF 符号扩展 LPE" 作者：senyuuri [文章] [CVE-2017-16995]
2019: "内核研究 / mmap 处理程序利用" 作者：deshal3v [文章] [CVE-2019-18675]
2019: "坏 Binder：Android 野外利用" 作者：Maddie Stone [文章] [CVE-2019-2215]
2019: "分析 Android 的 CVE-2019-2215 (/dev/binder UAF)" [文章] [CVE-2019-2215]
2019: "Stream Cut：使用 Binder 释放后利用进行 Android 内核利用 (CVE-2019-2215)" [视频] [CVE-2019-2215]
2019: "CVE-2019-2215 - Android 内核 binder 漏洞分析" [文章] [CVE-2019-2215]
2019: "可被利用的 Linux 内核漏洞深度分析" 作者：Tong Lin 和 Luhai Chen (Linux Security Summit EU) [视频] [CVE-2017-16995, CVE-2017-10661]
2019: "裁剪 CVE-2019-2215 以实现 root" 作者：Grant Hernandez [文章] [CVE-2019-2215]
2019: "从零到 root：利用类型混淆漏洞构建通用 Android Root" 作者：王勇 [幻灯片] [CVE-2018-9568, WrongZone]
2019: "KARMA 看攻防：WrongZone 从利用到修复" [文章] [CVE-2018-9568, WrongZone]
2019: "Android Binder：通往 Root 的桥" 作者：韩宏利 和 周明建 [幻灯片] [CVE-2019-2025]
2019: "Android 中的‘水滴’：一个 Binder 内核漏洞" 作者：韩宏利 [文章] [CVE-2019-2025]
2019: "容器逃逸实践练习" 作者：Nick Freeman [文章] [CVE-2017-1000112]
2019: "取自内核书的一页：mremap() 中的 TLB 问题" 作者：Jann Horn [文章] [CVE-2018-18281]
2019: "CVE-2018-18281 - Linux 内核 TLB 漏洞分析" [文章]
2019: "Linux xfrm 模块越界读写权限提升漏洞 (CVE-2017-7184) 分析" [文章] [CVE-2017-7184]
2019: "Linux ebpf 模块整数扩展导致的权限提升漏洞 (CVE-2017-16995) 分析" [文章] [CVE-2017-16995]
2019: "Linux 内核 4.20 BPF 整数溢出漏洞分析" [文章]
2019: "攻击 DRM 子系统以在 Chromebook 上获取内核权限" 作者：申迪 [幻灯片] [视频] [CVE-2019-16508]
2018: "Linux 内核 4.20 BPF 整数溢出-堆溢出漏洞及其利用" [文章]
2018: "CVE-2017-11176: 分步 Linux 内核利用" [文章] [CVE-2017-11176]
2018: "Linux 内存管理中的缓存失效漏洞" 作者：Jann Horn [文章] [CVE-2018-17182]
2018: "解剖一个 17 年历史的内核漏洞" 作者：Vitaly Nikolenko (beVX) [幻灯片] [CVE-2018-6554, CVE-2018-6555]
2018: "SSD 公告 – IRDA Linux 驱动 UAF" [文章] [CVE-2018-6554, CVE-2018-6555]
2018: "Linux 的 create_elf_tables() 中的整数溢出" [公告] [CVE-2018-14634]
2018: "MMap 漏洞 – Linux 内核" [文章] [CVE-2018-8781]
2018: "Ubuntu 内核 eBPF 0day 分析" [文章] [CVE-2017-16995]
2018: "eBPF 以及针对 CVE-2017-16995 的 get-rekt-linux-hardened.c 利用分析" [文章] [CVE-2017-16695]2017: "挑战不可能——Android 上的多重利用" 作者：韩翔文和王晓栋 [幻灯片] [CVE-2017-0437]
2017: "CVE-2017-1000112：利用 Linux 内核 UFO 数据包中的越界漏洞" 作者：Andrey Konovalov [文章] [CVE-2017-1000112]
2017: "Linux 内核漏洞可导致权限提升：分析 CVE-2017-1000112" 作者：Krishs Patil [文章] [CVE-2017-1000112]
2017: "将 CVE-2017-1000112 的 PoC 适配到其他内核" [文章] [CVE-2017-1000112]
2017: "在 Android 内核中利用非常规释放后使用漏洞的艺术" 作者：申迪 [幻灯片] [CVE-2017-0403, CVE-2016-6787] [视频]
2017: "在全面保护下利用 CVE-2017-5123：SMEP、SMAP 和 Chrome 沙箱！" 作者：Chris Salls [文章] [CVE-2017-5123]
2017: "利用 CVE-2017-5123" 作者：Federico Bento [文章] [CVE-2017-5123]
2017: "使用 waitid() 逃逸 Docker 容器 – CVE-2017-5123" 作者：Daniel Shapira [文章] [CVE-2017-5123]
2017: "LKE v4.13.x - waitid() LPE" 作者：HyeongChan Kim [文章] [CVE-2017-5123]
2017: "利用 CVE-2016-6787" [文章] [CVE-2016-6787]
2017: "Root 竞赛：Linux 内核条件竞争利用分析" 作者：Alexander Popov [视频] [CVE-2017-2636]
2017: "Root 竞赛：Linux 内核条件竞争利用分析" 作者：Alexander Popov [幻灯片] [CVE-2017-2636]
2017: "CVE-2017-2636：利用 n_hdlc Linux 内核驱动中的条件竞争绕过 SMEP" 作者：Alexander Popov [文章] [CVE-2017-2636]
2017: "CVE-2017-2636：n_hdlc 中的本地权限提升漏洞" 作者：Alexander Popov [公告] [CVE-2017-2636]
2017: "脏牛" [摘要] [利用] [CVE-2016-5195]
2017: "脏牛以及为什么撒谎不好，即便你是 Linux 内核" [文章] [CVE-2016-5195]
2017: "NDAY-2017-0103：sys_oabi_epoll_wait 中的任意内核写入" 作者：Zuk Avraham [文章] [CVE-2016-3857]
2017: "NDAY-2017-0106：NVIDIA nvhost-vic 驱动中的权限提升" 作者：Zuk Avraham [文章] [CVE-2016-2434]
2017: "PWN2OWN 2017 Linux 内核权限提升分析" [文章] [CVE-2017-7184]
2017: "通过数据包套接字利用 Linux 内核" 作者：Andrey Konovalov [文章] [CVE-2017-7308]
2017: "利用 CVE-2017-7308 解决后利用问题" [文章] [CVE-2017-7308]
2017: "NDAY-2017-0105：MSM 温控驱动中的权限提升漏洞" 作者：Zuk Avraham [文章] [CVE-2016-2411]
2017: "NDAY-2017-0102：NVIDIA 视频驱动中的权限提升漏洞" 作者：Zuk Avraham [文章] [CVE-2016-2435]
2017: "CVE-2017-6074：利用 Linux 内核 DCCP 套接字中的双重释放" 作者：Andrey Konovalov [文章] [CVE-2017-6074]
2016: "CVE-2016-8655 Linux af_packet.c 条件竞争（本地 root）" 作者：Philip Pettersson [公告] [CVE-2016-8655]
2016: "从扩展到利用，root 一切 Android" 作者：申迪和 James Fang 在 Black Hat 会议 [幻灯片] [文章] [CVE-2015-0570, CVE-2016-0820, CVE-2016-2475, CVE-2016-8453]
2016: "Talk is Cheap, Show Me the Code" 作者：James Fang、申迪和 Wen Niu [幻灯片] [CVE-2015-1805]
2016: "CVE-2016-3873：Nexus 9 中的任意内核写入" 作者：Sagi Kedmi [文章] [CVE-2016-3873]
2016: "利用 Linux 内核中的递归" 作者：Jann Horn [文章] [CVE-2016-1583]
2016: "Linux 内核漏洞（CVE-2016-0728）的分析与利用" 作者：Perception Point 研究团队 [文章] [CVE-2016-0728]
2016: "CVE20160728 利用代码详解" 作者：Shilong Zhao [文章] [CVE-2016-0728]
2016: "CVE-2016-0728 与 Android" 作者：Collin Mulliner [文章] [CVE-2016-0728]
2016: "关于 CVE-2016-7117 的笔记" 作者：Lizzie Dixon [文章] [CVE-2016-7117]
2016: "CVE-2016-2384：利用 usb-midi Linux 内核驱动中的双重释放" 作者：Andrey Konovalov [文章] [CVE-2016-2384]
2016: "CVE-2016-6187：利用 Linux 内核堆 off-by-one 漏洞" 作者：Vitaly Nikolenko [文章] [CVE-2016-6187]
2016: "CVE-2014-2851 group_info UAF 利用" 作者：Vitaly Nikolenko [文章] [CVE-2014-2851]
2016: "Perf：从性能分析到内核利用" 作者：Wish Wu 在 HITB Ams 会议 [幻灯片] [视频] [CVE-2016-0819]
2016: "QUADROOTER：影响超过 9 亿 Android 设备的新漏洞" [文章] [CVE-2016-2503, CVE-2106-2504, CVE-2016-2059, CVE-2016-5340]
2016: "让移动芯片组俯首称臣：来自南半球的新 0day" 作者：Adam Donenfeld 在 DEF CON 会议 [幻灯片] [CVE-2016-2503, CVE-2106-2504, CVE-2016-2059, CVE-2016-5340]
2015: "Android Linux 内核权限提升漏洞及其利用（CVE-2014-4322）" 作者：Gal Beniamini [文章] [CVE-2014-4322]
2015: "利用 'BadIRET' 漏洞" 作者：Rafal Wojtczuk [文章] [CVE-2014-9322]
2015: "关于利用 'BadIRET' 漏洞（CVE-2014-9322）的后续" 作者：Adam Zabrocki [文章] [CVE-2014-9322]
2015: "啊！通用 Android Root 回来了" 作者：Wen Xu 在 Black Hat 会议 [幻灯片] [视频] [论文] [CVE-2015-3636]
2015: "当溢出发生时" 作者：Keen Team [幻灯片]
2015: "利用 DRAM rowhammer 漏洞获取内核权限" 作者：Mark Seaborn 和 Thomas Dullien [文章] [Rowhammer]
2015: "CVE-2014-4943 - PPPoL2TP 拒绝服务分析" 作者：Vitaly Nikolenko [文章] [CVE-2014-4943]
2015: "CVE-2015-0568：Qualcomm MSM 7x30 摄像头驱动中的释放后使用漏洞" [文章] [CVE-2015-0568]
2014: "利用 CVE-2014-0196：Linux pty 条件竞争 PoC 的演练" 作者：Samuel Gross [文章] [CVE-2014-0196]
2014: "CVE-2014-4014：Linux 内核本地权限提升的 '利用'" 作者：Vitaly Nikolenko [文章] [CVE-2014-4014]
2014: "CVE-2014-4699：Linux 内核 ptrace/sysret 漏洞分析" 作者：Vitaly Nikolenko [文章] [CVE-2014-4699]
2014: "如何利用 x32 recvmmsg() 内核漏洞 CVE 2014-0038" 作者：Samuel Gross [文章] [CVE-2014-0038]
2014: "利用 Futex 漏洞并发现 Towelroot" [文章] [CVE-2014-3153]
2014: "CVE-2014-3153 利用" 作者：Joel Eriksson [文章] [CVE-2014-3153]
2013: "权限提升的内核利用" 作者：Julius Plenz [文章] [CVE-2013-1763]
2013: "深入剖析 Linux 近期的一个权限提升漏洞（CVE-2013-2094）" 作者：Joe Damato [文章] [CVE-2013-2094]
2012: "通过 SUID /proc/pid/mem 写入实现 Linux 本地权限提升" 作者：Jason Donenfeld [文章] [CVE-2012-0056]
2011: "通过未初始化栈的内核利用" 作者：Kees Cook 在 DEF CON 会议 [幻灯片] [视频] [CVE-2010-2963]
2010: "CVE-2010-2963 v4l compat 利用" 作者：Kees Cook [文章] [CVE-2010-2963]
2010: "利用 Linux 上 Xorg 服务器的大内存管理漏洞" 作者：Rafal Wojtczuk [文章] [CVE-2010-2240]
2010: "CVE-2007-4573：内核利用剖析" 作者：Nelson Elhage [文章] [CVE-2007-4573]
2010: "Linux 内核 CAN SLUB 溢出" 作者：Jon Oberheide [文章] [CVE-2010-2959]
2010: "af_can Linux 内核溢出" 作者：Ben Hawkes [文章] [CVE-2010-2959]
2010: "Linux compat 漏洞（第一部分）" 作者：Ben Hawkes [文章] [CVE-2010-3081]
2010: "Linux compat 漏洞（第二部分）" 作者：Ben Hawkes [文章] [CVE-2010-3301]
2010: "关于 CVE-2010-3081 可利用性的一些笔记" [文章] [CVE-2010-3081]
2010: "漏洞剖析：CVE-2010-3081" [文章] [CVE-2010-3081]
2010: "CVE-2010-4258：将拒绝服务转化为权限提升" 作者：Nelson Elhage [文章] [CVE-2010-4258]
2009: "因错误的 proto_ops 初始化导致 Linux 空指针解引用（CVE-2009-2692）" [文章] [CVE-2009-2692]
2009: "即使一个字节也很重要" [文章] [CVE-2009-1046]
2009: "CVE-2008-0009/CVE-2008-0010：Linux 内核 vmsplice(2) 权限提升" [文章] [CVE-2008-0009, CVE-2008-0010]
2008: "vmsplice()：本地 root 利用的诞生" 作者：Jonathan Corbet [文章] [CVE-2008-0600]
2004: "Linux 内核 do_mremap VMA 限制本地权限提升漏洞" [文章] [CVE-2004-0077]
2026: "从入侵我的 ISP 路由器到发现 MediaTek 内核 0day" 作者：Victor Fresco [文章] [CVE-2025-13942] [CVE-2025-13943] [CVE-2026-20452]
2025: "Eternal-Tux：利用 N-Day 构建 Linux 内核 KSMBD 零点击 RCE 利用" 作者：William Liu [文章] [CVE-2023-52440] [CVE-2023-4130]
2024: "听好了：Sonos 空中远程内核利用与隐蔽窃听" 作者：Robert Herrera 和 Alex Plaskett [文章] [幻灯片] [视频] [CVE-2023-50809] [CVE-2024-20018]
2023: "滥用 Linux 内核内 SMB 服务器实现内核远程代码执行" 作者：Guillaume Teissier 和 Quentin Minster [视频] [CVE-2022-47943] [CVE-2023-2593]
2022: "2022 年编写一个 Linux 内核远程利用" 作者：Samuel Page [文章] [幻灯片] [CVE-2022-0435]
2022: "Zenith：Pwn2Own TP-Link AC1750 智能无线路由器远程代码执行漏洞" 作者：Axel Souchet [文章] [CVE-2022-24354]
2021: "BleedingTooth：Linux 蓝牙零点击远程代码执行" 作者：Andy Nguyen：BadChoice, BadKarma, BadVibes [文章] [CVE-2020-12352, CVE-2020-12351, CVE-2020-24490]
2017: "空中利用：利用 Broadcom 的 Wi-Fi 栈（第二部分）" 作者：Gal Beniamini [文章] [CVE-2017-0569]
2017: "BlueBorn：蓝牙实现的风险——揭示现代蓝牙栈中的零日漏洞与安全缺陷" [论文] [CVE-2017-1000251]
2016: "CVE 发布：CVE 2016-8633" 作者：Eyal Itkin [文章] [CVE-2016-8633]
2011: "通过业余无线电夺取控制权：2011 年的远程内核利用" 在 DEF CON 会议 [幻灯片] [视频] [CVE-2011-1493]
2009: "当 '潜在的拒绝服务' 意味着一次远程内核利用：SCTP 的故事" [文章] [CVE-2009-0065]
2026: "Januscape：KVM/x86 从客户机到宿主的逃逸" 作者：Hyunwoo Kim [文章] [CVE-2026-53359]
2026: "边界错误缓冲：KVM SEV-SNP 中的越界读写（CVE-2026-53360）" 作者：Stan Shaw [文章] [CVE-2026-53360]
2026: "ITScape：KVM/arm64 从客户机到宿主的逃逸" 作者：Hyunwoo Kim [文章] [CVE-2026-46316]
2026: "当漏洞真实存在但路径并非如此：ITScape（CVE-2026-46316）与最小运行时的案例" 作者：Anastassios Nanos [文章] [CVE-2026-46316]
2021: "一个 EPYC 逃逸：KVM 突破案例研究" 作者：Felix Wilhelm [文章] [CVE-2021-29657]
2026: "futex: remove_waiter 栈 uaf" 作者：Guy Beck [文章] [CVE-UNKNOWN]
2026: "futex READ_ONCE" 作者：Guy Beck [文章] [CVE-UNKNOWN]
2026: "epoll uaf" 作者：Guy Beck [文章] [CVE-UNKNOWN]
2026: "Unix GC 重制版" 作者：Moe Acherir [文章] [CVE-2025-40214]
2026: "Linux 内核中的发现与验证（第一部分）：CAN 释放后使用竞态" 作者：Samuel Page [文章]
2026: "Linux 内核中的发现与验证（第二部分）：FUSE 页缓存溢出" 作者：Samuel Page [文章]
2026: "我的第一个 CVE - CVE-2026-23275 - io_uring 调整大小与 taskrun 竞态条件" [文章] [CVE-2026-23275]
2026: "WiFi/mac8021 中 TTLM 解析的越界单字节读取（空中）" 作者：Ruikai Peng [文章] [CVE-UNKNOWN]
2025: "从 adb 到 root，故障注入谷歌电视流媒体设备" 作者：Niek Timmers [幻灯片] [视频] [NO-CVE]
2025: "mediatek？不如叫 media-rekt，对吧。" 作者：hypr [文章]
2025: "剖析 Linux XFRM 子系统中的 1-Day 漏洞" 作者：Shreyas Penkar [文章] [CVE-2025-39965] [触发]
2025: "关于 CVE-2025-38617 的快速笔记" 作者：Pumpkin Chang [文章] [CVE-2025-38617]
2025: "快速且有缺陷——KGSL 故障处理中的释放后使用漏洞" 作者：Shreyas Penkar [文章] [CVE-2024-38399]2025: Shreyas Penkar 著 "Race Against Time in the Kernel’s Clockwork" [文章] [CVE-2025-38352]
2025: Pumpkin Chang 著 "Analysis of CVE-2025-37756, an UAF Vulnerability in Linux KTLS" [文章] [CVE-2025-37756]
2025: Slava Moskvin 著 "ZDI-25-310: Remote NULL Deref in Linux KSMBD" [文章] [CVE-2025-22037]
2025: "CVE-2024-36904 - Linux 内核 TCP 子系统中的释放后使用漏洞" [文章] [CVE-2024-36904]
2025: Pumpkin Chang 著 "Simply Analyzing Two N_GSM Vulnerabilities" [文章] [CVE-2024-36016]
2025: Pumpkin Chang 著 "A Quick Note On Two mempolicy Vulnerabilities" [文章] [CVE-2022-49080] [CVE-2023-4611]
2025: Pumpkin Chang 著 "The Evolution of Dirty COW" [文章] 第2部分 [CVE-2016-5195] [CVE-2017-1000405] [CVE-2022-2590]
2025: Pumpkin Chang 著 "A Quick Note on CVE-2024-53104" [文章] [CVE-2024-53104]
2025: Pumpkin Chang 著 "A Series of io_uring pbuf Vulnerabilities" [文章] [CVE-2024-0582] [CVE-2024-35880] [CVE-UNKNOWN]
2025: The io_uring Promotion in kernelCTF And Two Vulnerabilities Analysis [文章] [CVE-UNKNOWN] [CVE-2023-52926]
2025: Pumpkin Chang 著 "Linux Kernel Some Vsock Vulnerabilities Analysis" [文章] [CVE-2025-21669] [CVE-2025-21670] [CVE-2025-21666]
2025: Pumpkin Chang 著 "From Zero to Emo – My Journey of Many Failures in kernelCTF" [文章] [CVE-2024-56770] [CVE-2025-21703] [CVE-2025-21700]
2025: Pumpkin Chang 著 "A 1-day a Day in the Lunar New Year" [文章] [CVE-UNKNOWN]
2025: Pumpkin Chang 著 "Memory-related CVEs Exploited in kernelCTF" [文章] [CVE-2024-50066] [CVE-2023-3269]
2025: Pumpkin Chang 著 "Two Network-related vunlnerabilities Analysis" [文章] [CVE-2023-6932] [CVE-2023-0461]
2025: "Cellebrite zero-day exploit used to target phone of Serbian student activist" [文章] [CVE-2024-53104] [CVE-2024-53197] [CVE-2024-50302] 注释1 注释2 注释3 注释4 注释5 注释6 注释7
2025: Anderson Nascimento 著 "Accidentally uncovering a seven years old vulnerability in the Linux kernel" [文章] [CVE-2024-36904]
2025: Jordy Zomer 著 "Linux Kernel: Out of bounds Write in ksmbd_vfs_stream_write" [文章] [CVE-2024-56626]
2025: Jordy Zomer 著 "Linux Kernel: Out of bounds Read in ksmbd_vfs_stream_read" [文章] [CVE-2024-56627]
2025: Jordy Zomer 著 "Linux Kernel: Integer Overflow in eBPF XSK map_delete_elem Leads to Out-of-Bounds" [文章] [CVE-2024-56614]
2025: Jordy Zomer 著 "Integer Overflow in eBPF DEVMAP map_delete_elem Leads to Out-of-Bounds" [文章] [CVE-2024-56615]
2025: Pumpkin Chang 著 "Some Casual Notes for CVE-2024-26921" [文章] [CVE-2024-26921]
2024: Pumpkin Chang 著 "Linux Kernel ICMPv6 & CVE-2023-6200" [文章] [CVE-2023-6200]
2024: Pumpkin Chang 著 "Linux Kernel Perf CVE-2023-5717 Quick Analysis" [文章] [CVE-2023-5717]
2024: Pumpkin Chang 著 "A Quick Note for Perf CVE-2024-46713" [文章] [CVE-2024-46713]
2024: Pumpkin Chang 著 "Linux Kernel Perf CVE-2023-6931 Analysis" [文章] [CVE-2023-6931]
2024: Pumpkin Chang 著 "Linux Kernel Vsock 1-day Analysis" [文章] [CVE-UNKNOWN]
2024: Pumpkin Chang 著 "Three Linux net/sched 1-day Analysis" [文章] [CVE-2024-36974] [CVE-2023-0590]
2024: Pumpkin Chang 著 "Two Linux net/sched 1-day Analysis" [文章] [CVE-2024-36978]
2024: Pumpkin Chang 著 "CVE-2024-41010 - Linux net/sched UAF 1-day Analysis" [文章] [CVE-2024-41010]
2024: Pumpkin Chang 著 "Linux eBPF Design and Vulnerability Case Study" [文章] 第2部分 [CVE-2024-41009] [CVE-2022-23222] [CVE-2023-52447]
2024: Marco Vanotti 著 "Linux Kernel: TOCTOU in Exec System" [文章] [CVE-2024-43882]
2024: Maher Azzouzi 著 "CVE-2024-26926 Analysis" [文章] [CVE-2024-26926]
2024: "CVE-2024-44068: Samsung m2m1shot_scaler0 设备驱动页面释放后使用（Android）" [文章] [CVE-2024-44068]
2024: "深入剖析 RCU 竞态条件：TCP-AO 释放后使用分析 (CVE-2024-27394)" [文章] [CVE-2024-27394]
2024: Sam Page 著 "ZDI-24-821: 内核 net/tipc 中的远程释放后使用" [文章] [ZDI-24-821] [CVE-2024-36886]
2024: "关于 ksmbd 中 ZDI-24-195 的笔记" [帖文] [ZDI-24-195]
2024: "PowerVR GPU - 通过 RGXCreateFreeList 导致 GPU 固件可覆写任意内核页面" [报告]
2024: "PowerVR GPU - 通过 DevmemIntPFNotify 与 DevmemIntCtxRelease 导致的释放后使用竞态条件" [报告]
2023: Jean-Baptiste Cayrou 著 "Ubuntu Shiftfs: 不平衡解锁利用尝试" [幻灯片] [CVE-2023-2612]
2023: "攻击多平台 NPU" [幻灯片] [CVE-2022-22265] [CVE-2020-28343] [SVE-2021-20204] [CVE-2023-42483] [CVE-2023-45864]
2023: Alisa Esage 著 "深入剖析：2023 年 10 月 Qualcomm MSM Linux 内核与 ARM Mali GPU 0day 漏洞利用攻击" [文章] [CVE-2023-33063] [CVE-2023-33106] [CVE-2023-33107] [CVE-2022-22071] [CVE-2023-4211]
2023: notselwyn 著 "解锁 ksmbd：Linux 内核的远程利用 (ZDI-23-979, ZDI-23-980)" [文章] [CVE-2023-3866] [CVE-2023-3865] 利用代码
2023: Maxim Suhanov 著 "CVE-2023-4273：Linux exFAT 驱动程序中的漏洞" [文章] [CVE-2023-4273]
2023: Max VA 著 "Linux IPv6 'Route of Death' 0day" [文章] [CVE-2023-2156]
2022: "Linux 内核：蓝牙 L2CAP 处理中的信息泄露" [公告] [CVE-2022-42895]
2022: "Linux 内核：蓝牙 L2CAP 握手中的释放后使用" [公告] [CVE-2022-42896]
2022: "CVE-2022-41218 的漏洞详情" [文章] [CVE-2022-41218]
2022: "竞速 Cat 到出口：一个乏味的 Linux 内核释放后使用" [文章]
2022: "Android 通用 Root：利用 xPU 驱动程序" [幻灯片] [CVE-2022-20122] [CVE-2021-39815]
2022: Xingyu Jin 著 "Linux 内核垃圾回收的量子态 CVE-2021-0920（第一部分）" [文章] [CVE-2021-0920]
2022: Itay Iellin 著 "在 Linux 内核蓝牙子系统中寻找漏洞" [文章] 第2部分
2022: Samuel Page 著 "CVE-2022-0435: Linux 内核中的远程栈溢出" [文章] [CVE-2022-0435]
2022: Max Van Amernngen 著 "CVE-2021-45608 | 数百万终端用户路由器中的 NetUSB RCE 漏洞" [文章] [CVE-2021-45608]
2021: Jann Horn 著 "CVE-2021-1048: 销毁中的文件引用计数增加" [文章] [CVE-2021-1048]
2021: Martijn Bogaard 与 Dana Geist 著 "通过恶意 USB 设备实现 Linux 内核代码执行" [幻灯片] [CVE-2016-2384]
2021: "SLUB 溢出 CVE-2021-42327" [文章] [CVE-2021-42327]
2021: pjlantz 著 "CVE-2021-44733: Linux 内核 TEE 子系统中的释放后使用——模糊测试与利用" [文章] PoC [CVE-2021-44733]
2021: Max Van Amerongen 著 "CVE-2021-43267: 远程 Linux 内核堆溢出 | TIPC 模块允许任意代码执行" [文章] [CVE-2021-43267]
2021: Ben Hawkes 著 "CVE-2021-1905: Qualcomm Adreno GPU 内存映射释放后使用" [文章] [CVE-2021-1905]
2021: Ayaz Mammadov 著 "渗入 Android 上的 Linux 内核利用" [文章]
2020: "CVE-2020-16119" [文章] [CVE-2020-16119]
2020: Adam Zabrocki 著 "一个 Linux 内核释放后使用漏洞与两个 CVE 的简短故事 (CVE-2020-14356 与 CVE-2020-25220)" [文章] [CVE-2020-14356, CVE-2020-25220]
