Gonna be teaching Exploiting the Linux Kernel training at RomHack in Rome on September 28 — October 1st. Last planned session of this training for the year. Early Bird discount until the end of the week. romhack.io/training/202...

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

June updates · xairy/linux-kernel-exploitation@1120e9c

github.com

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

March/April/May updates · xairy/linux-kernel-exploitation@a8811cb

github.com

Gonna be teaching Exploiting the Linux Kernel training at RomHack in Rome on September 28 — October 1st. Last planned session of this training for the year. Early Bird discount until the end of the week. romhack.io/training/202...

Recent Page Cache Corruption Bugs All stem from code paths that allow in-place overwrites of user-supplied input pages without verifying they are writable. This enables overwriting page cache and thus changing in-memory contents of read-only files. Selected links below ⬇️

From KernelSnitch to Practical msg_msg/pipe_buffer Heap KASLR Leaks Article by Lukas Maar about evaluating the KernelSnitch timing side-channel attack on a variety of systems, including Android. lukasmaar.github.io/posts/heap-k...

2 years ago I did a PoC to run #rust 🦀 in the #pixel modem Today it shipped in millions of devices! They grow up to fast! 🥲 security.googleblog.com/2026/04/brin... #rust #security #smartphone #baseband

Bringing Rust to the Pixel Baseband

Posted by Jiacheng Lu, Software Engineer, Google Pixel Team Google is continuously advancing the security of Pixel devices. We have been f...

security.googleblog.com

Software-only timing side-channel leaking mm_struct without a memory-safety bug, pivoting via cross-cache reuse to msg_msg/pipe_buffer, effective even on MTE. lukasmaar.github.io/posts/heap-k... Credits: Lukas Maar #infosec

New BSides Canberra 2025 talk by Angus is now live: “Walkthrough of an N-day Android GPU driver vulnerability.” Watch here: youtu.be/G71dB0C4-dY

Walkthrough of an N-day Android GPU driver vulnerability - Angus Atkinson, BSides Canberra 2025

YouTube video by BSides Canberra

youtu.be

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets Excellent article by Quang Le about exploiting CVE-2025-38617 — a race condition that leads to a use-after-free in the packet sockets implementation. blog.calif.io/p/a-race-wit...

Extended the Pixel 8 KGDB article with the instructions on how to set up GEF. slub-dump, buddy-dump, and some other commands now work. Huge thanks to bata24 for implementing all required pieces. xairy.io/articles/pix...

📲 Debugging the Pixel 8 kernel via KGDB

Instructions for getting kernel log, building custom kernel, and enabling KGDB on Pixel 8

xairy.io

Gonna be teaching Exploiting the Android Kernel training at Zer0Con 2026 on March 30th — April 1st. This is a new training focused on data-only Android kernel exploitation techniques. Just a bit of time left to sign up. Pay attention to the requirements. zer0con.org#training-sec...

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

January/February updates · xairy/linux-kernel-exploitation@80d541e

github.com

Gonna be teaching Fuzzing the Linux Kernel training online via Ringzer0 on March 20–25. Covers using/extending syzkaller and KASAN and related areas. I don't deliver this training often, so don't miss the opportunity. ringzer0.training/countermeasu...

Fuzzing the Linux Kernel

This training guides security researchers and software engineers through the field of Linux kernel fuzzing. In a series of lectures and practical labs, the training explores using fuzzing for finding ...

ringzer0.training

The end of a good time slab: remove struct kmem_cache_cpu git.kernel.org/pub/scm/linu... slab: remove cpu (partial) slabs usage from allocation paths git.kernel.org/pub/scm/linu...

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

November/December updates · xairy/linux-kernel-exploitation@50a2069

github.com

Today, Project Zero released a 0-click exploit chain for the Pixel 9. While it targets the Pixel, the 0-click bug and exploit techniques we used apply to most other Android devices. projectzero.google/2026/01/pixe...

🚨 REcon 2026 is LIVE! 🚀 Call for papers and registration are now open! Join the world's top reverse engineers & exploit devs in Montreal: 🛠 Trainings: June 15-18 📅 Conference: June 19-21 Tickets & early bird now open → recon.cx Limited spots – see you in MTL! #REcon2026 #ReverseEngineering

@andreyknvl.bsky.social I don't know if this ever got brought up, but for a much more convenient way of doing this, Steam Deck supports this out of the box. You flip the toggle in BIOS, which is exposed by default, and then you can use the gadget directly within the OS. xairy.io/articles/thi...

🤫 Unlocking secret ThinkPad functionality for emulating USB devices

Enabling and using xDCI controller on ThinkPad X1 Carbon 6th Gen

xairy.io

Gonna be teaching Exploiting the Linux Kernel training at @offensivecon.bsky.social in Berlin on May 11–14th. Half of the spots already taken, so don't miss out. Also note that you can get a conference ticket as a bundle with a training.

OffensiveCon@offensivecon.bsky.social · 8mo ago

🚨 In 2026, Andrey Konovalov - @andreyknvl.bsky.social - returns to OffensiveCon with a training on "Exploiting the Linux Kernel". Find more details here🔗https://buff.ly/dKDboYt 🚀 Don't miss this chance to improve your skills—sign up now!

🚨 In 2026, Andrey Konovalov - @andreyknvl.bsky.social - returns to OffensiveCon with a training on "Exploiting the Linux Kernel". Find more details here🔗https://buff.ly/dKDboYt 🚀 Don't miss this chance to improve your skills—sign up now!

The trainings' content is unique and exclusive to #offensivecon26, so don’t miss out! NEW: Get your training + conference ticket bundle and secure a conference ticket before the conference ticket shop opens! Tickets: buff.ly/z8YNgoY Don't worry, the conference ticket shop will open…at some point

This is still not fixed btw.

Andrey Konovalov@andreyknvl.bsky.social · 11mo ago

Wrote a trigger for CVE-2025-38494/5 (an integer underflow in the HID subsystem) that leaks 64 KB of OOB memory over USB. Still works on Pixels and Ubuntus (but the bug is fixed in stable kernels). github.com/xairy/kernel...

kernelCTF: CVE-2025-38477 kernelCTF entry for a race condition in the network scheduler subsystem. Most notably, shows a technique of putting controlled data into unmapped sections of vmlinux. github.com/n132/securit...

Defeating KASLR by Doing Nothing at All Article by Seth Jenkins about a few problems with physical memory KASLR on arm64 devices. googleprojectzero.blogspot.com/2025/11/defe...

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

September/October updates · xairy/linux-kernel-exploitation@b26cc4a

github.com

Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers Article by Robin Bastide about exploiting a NULL-pointer-dereference that led to a UAF access to the kernel stack in the NVIDIA GPU driver. blog.quarkslab.com/nvidia_gpu_k...

Sheaves support has been merged into SLUB. Opt-in for now, but planned to replace the per-CPU partial slab layer for all caches in the future. Gonna have to revise the slab shaping strategies once this happens.

Delivered a workshop at BalcCon this weekend on emulating/sniffing/MitM'ing USB devices with Raw Gadget and a Raspberry Pi. All materials are public, so can go through the workshop on your own if you're interested. github.com/xairy/raw-ga...

Updated syzkaller documentation on USB fuzzing to explain how to handle certain tricky cases (e.g. driver quirks applied based on Vendor/Product IDs). github.com/google/syzka...

docs: update USB documentation · google/syzkaller@e2beed9

github.com