From KernelSnitch to Practical msg_msg/pipe_buffer Heap KASLR Leaks

Article by Lukas Maar about evaluating the KernelSnitch timing side-channel attack on a variety of systems, including Android.

The attack allows leaking addresses of exploitation-relevant kernel allocations.

Lukas also published the source code for executing the attack.

Walkthrough of an N-day Android GPU driver vulnerability

Talk by Angus about analyzing CVE-2022-22706 — a logical bug in the Mali GPU driver that allows getting write access to read-only memory.

Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs

Hyunwoo Kim published an article describing a complicated exploit of a race condition caused by a misuse of the cancel_work_sync() kernel API in the network subsystem.

Some notes on the security properties of the pipe_buffer kernel object

a13xp0p0v (me) posted an article about a few experiments with the pipe_buffer kernel object within his kernel-hack-drill project.

Alexander described multiple pipe_buffer features relevant for kernel exploits that rely on this object.

Recent Page Cache Corruption Bugs

Multitude of vulnerabilities that allow overwriting the page cache and thus changing the in-memory contents of read-only files to gain LPE or escape a container in certain scenarios.

All stem from kernel code paths that perform in-place overwrites of user-supplied input pages without verifying that the pages are writable.

Copy Fail (CVE-2026-31431):

— Announcement;
— Better write-up.

Dirty Frag (CVE-2026-43284 and CVE-2026-43500):

— Covers two independent vulnerabilities that do not require chaining;
— CVE-2026-43284 is alternatively titled Copy Fail 2;
— Original write-up;
— Avoiding bruteforcing for CVE-2026-43500.

Fragnesia (CVE-2026-46300):

— Original report;
— Variant.

DirtyCBC / DirtyDecrypt (CVE-2026-31635?):

— Write-up;
— Another exploit.

Discovery & Validation in the Linux Kernel

Three-part article by Samuel Page about analyzing two vulnerabilities (in CAN sockets and FUSE) and attempting to use local LLMs to rediscover the bugs.

Privilege Escalation via a Page Use-After-Free in Qualcomm's AI Accelerator Linux Kernel Driver

Article by Lukas Maar about exploiting a bug in the mmap handler of the QAIC driver that causes a page UAF.

StepStone: LLM-Based GPU Kernel Driver Fuzzing via User-Space Libraries

Paper by Xiaochen Zou et. al about using LLMs for generating syzkaller descriptions for fuzzing GPU drivers via their userspace libraries APIs.

Logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333)

Article about a logical bug in the ptrace implementation that allows getting access to file descriptors of other processes and thus escalating privileges in certain scenarios.

PinTheft Linux LPE

Aaron Esau published an LPE exploit for a page double-free bug in the RDS zerocopy implementation, which can be turned into a page-cache overwrite through io_uring.

Unix GC Remastered

Article by Moe Acherir about the internals of the new Unix sockets garbage collector implementation and the analysis of CVE-2025-40214, which was used in a kernelCTF entry.

CIFSwitch: a non-universal Linux local root vulnerability

Asim Viladi Oglu Manizada posted an article about a nice logic bug in the interaction between the kernel CIFS subsystem and the userspace cifs-utils package.

An attacker can forge a "cifs.spnego" key in Linux keyring to make the kernel run a root userspace helper to escalate privileges of the attacker's process.

Off By !: Exploiting a Use-after-Free in the Linux Kernel

Oliver Sieber published a write-up about CVE-2026-23111 in nftables, which they found in early 2025 and other researchers patched upstream in February 2026. The article describes exploiting this UAF on Debian and Ubuntu.

Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215)

Stan Shaw published an article about exploiting UAF in a DRM GEM ioctl. The researcher reallocated freed memory as a pipe_buffer array to set PIPE_BUF_FLAG_CAN_MERGE and perform the Dirty Pipe attack.

Bad Epoll: The bug missed by Mythos

Article by Jaeyoung Chung about exploiting CVE-2026-46242 — a race condition bug in the eventpoll subsystem. Jaeyoung exploited this bug to claim a kernelCTF entry, but the vulnerability also affects Android kernels.

ITScape: Guest-to-Host Escape in KVM/arm64

Article by Hyunwoo Kim about exploiting a race condition bug in the KVM driver on the arm64 architecture to escape the guest VM.

Januscape: Guest-to-Host Escape in KVM/x86

Hyunwoo Kim published an article about a use-after-free vulnerability in the shadow MMU emulation of KVM/x86 (CVE-2026-53359). Both Intel (VMX) and AMD (SVM) code is affected.

The article only covers achieving a kernel crash via this bug, but the vulnerability can also be exploited to escape the guest VM. The author used this bug to pwn a kvmCTF instance.

Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694)

Article by Stan Shaw about exploiting a page OOB write bug in the FUSE subsystem by overwriting /etc/passwd in the page cache.