Linux Kernel Security

Bad UVM Article by Ziyi Guo about escaping an NVidia Container Toolkit container by exploiting a logical bug in the NVidia GPU driver.

When Defenses Become Attack Surface: CVE-2026-20971, a Samsung Kernel UAF Article about analyzing exploitation primitives derived from a racy use-after-free bug in the Samsung PROCA (Process Authenticator) kernel module.

SoK: Take a Deep Step into Linux Kernel Hardening Effectiveness from the Offensive-Defensive Perspective A paper with analysis of 121 publicly documented exploits since 2015 and in-depth evaluation of 51 existing kernel defense mechanisms.

PageJack in Action: CVE-2022-0995 exploit Article by Jean Vincent describing how a relatively old CVE can be exploited using the PageJack exploitation technique.

CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel Paper by Dong-ok Kim, Juhyun Song, et al. documenting the steps for executing cross-cache attacks for caches with min_partial >= cpu_partial_slabs. The paper also describes a fuzzing-based…

Testing race conditions with memory access tracing and stack-based delay injection Article by Jann Horn about MAccConc — a KCOV-based tool for exploring possible kernel code interleavings of a multi-threaded program.

SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free Article about exploiting CVE-2026-64564 in the implementation of the Stream Control Transmission Protocol (SCTP). Authors exploited a UAF in the kmalloc-1k cache to gain root and escape a containe…

Gone in 60 Frames – USB Video Exploitation Article (and slides) by Alex Plaskett and Robert Herrera about fuzzing USB drivers with syzkaller and writing an exploit that gains code execution over USB on Ubuntu.