PinTheft Linux LPE

Aaron Esau published an LPE exploit for a page double-free bug in the RDS zerocopy implementation, which can be turned into a page-cache overwrite through io_uring.

Unix GC Remastered

Article by Moe Acherir about the internals of the new Unix sockets garbage collector implementation and the analysis of CVE-2025-40214, which was used in a kernelCTF entry.

CIFSwitch: a non-universal Linux local root vulnerability

Asim Viladi Oglu Manizada posted an article about a nice logic bug in the interaction between the kernel CIFS subsystem and the userspace cifs-utils package.

An attacker can forge a "cifs.spnego" key in Linux keyring to make the kernel run a root userspace helper to escalate privileges of the attacker's process.

Off By !: Exploiting a Use-after-Free in the Linux Kernel

Oliver Sieber published a write-up about CVE-2026-23111 in nftables, which they found in early 2025 and other researchers patched upstream in February 2026. The article describes exploiting this UAF on Debian and Ubuntu.

Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215)

Stan Shaw published an article about exploiting UAF in a DRM GEM ioctl. The researcher reallocated freed memory as a pipe_buffer array to set PIPE_BUF_FLAG_CAN_MERGE and perform the Dirty Pipe attack.

Bad Epoll: The bug missed by Mythos

Article by Jaeyoung Chung about exploiting CVE-2026-46242 — a race condition bug in the eventpoll subsystem. Jaeyoung exploited this bug to claim a kernelCTF entry, but the vulnerability also affects Android kernels.

ITScape: Guest-to-Host Escape in KVM/arm64

Article by Hyunwoo Kim about exploiting a race condition bug in the KVM driver on the arm64 architecture to escape the guest VM.

Januscape: Guest-to-Host Escape in KVM/x86

Hyunwoo Kim published an article about a use-after-free vulnerability in the shadow MMU emulation of KVM/x86 (CVE-2026-53359). Both Intel (VMX) and AMD (SVM) code is affected.

The article only covers achieving a kernel crash via this bug, but the vulnerability can also be exploited to escape the guest VM. The author used this bug to pwn a kvmCTF instance.

Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694)

Article by Stan Shaw about exploiting a page OOB write bug in the FUSE subsystem by overwriting /etc/passwd in the page cache.

IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years

Article about exploiting a racy stack use-after-free in the futex implementation. The bug was used to pwn a kernelCTF instance.

I handed the epoll UAF to an agent

Article by Guy Beck about using Claude for porting an exploit for an eventpoll vulnerability to Android.

IonStack part III: Rooting Android 17 with GhostLock

Article about adapting the exploit of CVE-2026-43499 (racy stack use-after-free in the futex implementation) to Android.

The researchers used KernelSnitch, ashmem fops overwriting, pipe_buffer corruption, and other tricks to perform LPE.

Gone in 60 Frames – USB Video Exploitation

Article (and slides) by Alex Plaskett and Robert Herrera about fuzzing USB drivers with syzkaller and writing an exploit that gains code execution over USB on Ubuntu.

SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free

Article about exploiting CVE-2026-64564 in the implementation of the Stream Control Transmission Protocol (SCTP). Authors exploited a UAF in the kmalloc-1k cache to gain root and escape a container.

Testing race conditions with memory access tracing and stack-based delay injection

Article by Jann Horn about MAccConc — a KCOV-based tool for exploring possible kernel code interleavings of a multi-threaded program.

CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel

Paper by Dong-ok Kim, Juhyun Song, et al. documenting the steps for executing cross-cache attacks for caches with min_partial >= cpu_partial_slabs.

The paper also describes a fuzzing-based approach of finding target slab objects useful for exploitation.

PageJack in Action: CVE-2022-0995 exploit

Article by Jean Vincent describing how a relatively old CVE can be exploited using the PageJack exploitation technique.

SoK: Take a Deep Step into Linux Kernel Hardening Effectiveness from the Offensive-Defensive Perspective

A paper with analysis of 121 publicly documented exploits since 2015 and in-depth evaluation of 51 existing kernel defense mechanisms.

When Defenses Become Attack Surface: CVE-2026-20971, a Samsung Kernel UAF

Article about analyzing exploitation primitives derived from a racy use-after-free bug in the Samsung PROCA (Process Authenticator) kernel module.

Bad UVM

Article by Ziyi Guo about escaping an NVidia Container Toolkit container by exploiting a logical bug in the NVidia GPU driver.