I handed the epoll UAF to an agent Article by Guy Beck about using Claude for porting an exploit for an eventpoll vulnerability to Android. guysrd.github.io/epoll-uaf-ag...

IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years Article about exploiting a racy stack use-after-free in the futex implementation. The bug was used to pwn a kernelCTF instance. nebusec.ai/research/ion...

Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694) Article by Stan Shaw about exploiting a page OOB write bug in the FUSE subsystem by overwriting /etc/passwd in the page cache. cyberstan.co.uk/fuse-readdir...

Januscape: Guest-to-Host Escape in KVM/x86 Hyunwoo Kim published an article about a use-after-free vulnerability in the shadow MMU emulation of KVM/x86 (CVE-2026-53359). Both Intel (VMX) and AMD (SVM) code is affected. github.com/V4bel/Janusc...

ITScape: Guest-to-Host Escape in KVM/arm64 Article by Hyunwoo Kim about exploiting a race condition bug in the KVM driver on the arm64 architecture to escape the guest VM. github.com/V4bel/ITScape

Bad Epoll: The bug missed by Mythos Article by Jaeyoung Chung about exploiting CVE-2026-46242 — a race condition bug in the eventpoll subsystem. Jaeyoung exploited this bug to claim a kernelCTF entry, but the vulnerability also affects Android kernels. github.com/J-jaeyoung/b...

Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215) Stan Shaw published an article about exploiting UAF in a DRM GEM ioctl. The researcher reallocated freed memory as a pipe_buffer array to perform the Dirty Pipe attack. cyberstan.co.uk/drm-lpe-linux/

Off By !: Exploiting a Use-after-Free in the Linux Kernel Oliver Sieber published write-up on CVE-2026-23111 in nftables, found in early 2025, patched upstream by other researchers in Feb 2026. Article describes exploiting this UAF on Debian and Ubuntu. blog.exodusintel.com/2026/06/08/o...

CIFSwitch: a non-universal Linux local root vulnerability Asim Viladi Oglu Manizada posted an article about a nice logic bug in the interaction between the kernel CIFS subsystem and the userspace cifs-utils package. heyitsas.im/posts/cifswi...

CIFSwitch: a non-universal Linux local root vulnerability

Harnessing LLMs into composing complex, multihop vulnerability chains to discover CVE-2026-46243

heyitsas.im

Unix GC Remastered Article by Moe Acherir about the internals of the new Unix sockets garbage collector implementation and the analysis of CVE-2025-40214, which was used in a kernelCTF entry. mohandacherir.github.io/Qdiv7/posts/...

PinTheft Linux LPE Aaron Esau published an LPE exploit for a page double-free bug in the RDS zerocopy implementation, which can be turned into a page-cache overwrite through io_uring. github.com/v12-security...

pocs/pintheft at main · v12-security/pocs

poc it like it's hot. Contribute to v12-security/pocs development by creating an account on GitHub.

github.com

Logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333) Article about a logical bug in the ptrace implementation that allows getting access to file descriptors of other processes and thus escalating privileges in certain scenarios. cdn2.qualys.com/advisory/202...

StepStone: LLM-Based GPU Kernel Driver Fuzzing via User-Space Libraries Paper by Xiaochen Zou et. al about using LLMs for generating syzkaller descriptions for fuzzing GPU drivers via their userspace libraries APIs. www.cs.ucr.edu/%7Ezhiyunq/p...

Privilege Escalation via a Page Use-After-Free in Qualcomm's AI Accelerator Linux Kernel Driver Article by Lukas Maar about exploiting a bug in the mmap handler of the QAIC driver that causes a page UAF. lukasmaar.github.io/posts/qaic-p...

Discovery & Validation in the Linux Kernel Three-part article by @sam4k.com about analyzing two vulnerabilities (in CAN sockets and FUSE) and attempting to use local LLMs to rediscover the bugs. Final part: bynar.io/blog/discove...

Recent Page Cache Corruption Bugs All stem from code paths that allow in-place overwrites of user-supplied input pages without verifying they are writable. This enables overwriting page cache and thus changing in-memory contents of read-only files. Selected links below ⬇️

Some notes on the security properties of the pipe_buffer kernel object Alexander Popov posted an article about a few experiments with the pipe_buffer kernel object within his kernel-hack-drill project. a13xp0p0v.github.io/2026/04/20/p...

Some notes on the security properties of the pipe_buffer kernel object

Many exploits of Linux kernel vulnerabilities use the pipe_buffer kernel object to build strong exploit primitives. When I was experimenting with my personal project kernel-hack-drill, I discovered so...

a13xp0p0v.github.io

Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs Hyunwoo Kim published an article describing a complicated exploit of a race condition caused by a misuse of the cancel_work_sync() kernel API in the network subsystem. v4bel.github.io/linux/2026/0...

Walkthrough of an N-day Android GPU driver vulnerability Talk by Angus about analyzing CVE-2022-22706 — a logical bug in the Mali GPU driver that allows getting write access to read-only memory. www.youtube.com/watch?v=G71d...

Walkthrough of an N-day Android GPU driver vulnerability - Angus, BSides Canberra 2025

YouTube video by BSides Canberra

youtube.com

From KernelSnitch to Practical msg_msg/pipe_buffer Heap KASLR Leaks Article by Lukas Maar about evaluating the KernelSnitch timing side-channel attack on a variety of systems, including Android. lukasmaar.github.io/posts/heap-k...

Assessing Claude Mythos Preview’s cybersecurity capabilities Article by Nicholas Carlini et. al about the security research capabilities of the new Anthropic's LLM called Claude Mythos Preview. red.anthropic.com/2026/mythos-...

slab: support for compiler-assisted type-based slab cache partitioning Marco Elver posted a kernel patch that provides an alternative mode to RANDOM_KMALLOC_CACHES called TYPED_KMALLOC_CACHES. lore.kernel.org/all/20260331...

CrackArmor: Multiple vulnerabilities in AppArmor Article about a variety of vulnerabilities found in the AppArmor LSM implementation, including a few kernel memory corruptions. Authors exploited them to achieve LPE on Ubuntu and Debian. cdn2.qualys.com/advisory/202...

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets Excellent article by Quang Le about exploiting CVE-2025-38617 — a race condition that leads to a use-after-free in the packet sockets implementation. blog.calif.io/p/a-race-wit...

Analysis of Linux kernel bug fixes Jenny Guanni Qu posted a detailed analysis: — Kernel bugs hide for 2 years on average. Some hide for 20. pebblebed.com/blog/kernel-... — Who Writes the Bugs? A Deeper Look at 125,000 Kernel Vulnerabilities pebblebed.com/blog/kernel-...

setresuid(⚡): Glitching Google's TV Streamer from adb to root. Talk by Niek Timmers about glitching the kernel of the Android-based Google TV Streamer device to escalate privileges via Electromagnetic Fault Injection. Video: www.youtube.com/watch?v=-w5m... Slides: hardwear.io/netherlands-...

Hardwear.io NL 2025: Glitching Google's TV Streamer From Adb To Root - Niek Timmers

YouTube video by hardwear.io

youtube.com

[Cryptodev-linux] Page-level UAF exploitation nasm_re posted an article about exploiting a page-level UAF in the out-of-tree cryptodev-linux driver. The researcher modified struct file sprayed into a freed page to escalate privileges. nasm.re/posts/crypto...

[Cryptodev-linux] Page-level UAF exploitation

IntroductionIn november 2025 I started a fuzzing campaign against cryptodev-linux as part of a school project. I found +10 bugs (UAF, NULL pointer dereferences and integer overflows) and among all of

nasm.re

Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers Talk by Xingyu Jin & Martijn Bogaard about a new type of logical bugs in kernel driver mmap handlers exploitable via the ptrace functionality. Video: www.youtube.com/watch?v=yAUJ... Slides: powerofcommunity.net/2025/slide/x...

POC2025 | Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers

YouTube video by POC2026

youtube.com

A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave Article by Seth Jenkins about exploiting a use-after-free in the driver for BigWave — an AV1 decoding hardware component present on Pixel SOCs. projectzero.google/2026/01/pixe...

Article series about exploiting CVE-2025-38352 Faith posted three articles about exploiting a race condition in the implementation of POSIX CPU timers. Part 1️⃣ describes reproducing this race condition: faith2dxy.xyz/2025-12-22/c...

CVE-2025-38352 (Part 1) - In-the-wild Android Kernel Vulnerability Analysis + PoC

Analyzing and writing a PoC for CVE-2025-38352.

faith2dxy.xyz