architect/skills/linux-kernel-exploitation.md

---
name: linux-kernel-exploitation
domain: kernel
triggers:
  languages:    [c, asm, rust]
  frameworks:   [linux, bpf, kvm, io_uring]
  asset_types:  [kernel, driver, module, syscall, ebpf]
tools:          [syzkaller, kasan, kfence, crash, gdb, drgn, bpftool]
severity_focus: [P1, P2]
---

# Linux Kernel Exploitation

## When to load
`drivers/`, `fs/`, `net/`, `kernel/`, `mm/`, any `*.ko` module source, eBPF
programs (`*.bpf.c`), or container-escape research.

## Bug classes (with payout tiers)
1. **UAF / double-free** in `slab` allocator — heap-spray with
   `setxattr` / `msgsnd`, escalate via `cred` overlap. Pays $50K+.
2. **Type confusion** in BPF verifier — old classic, still finds in JIT
   re-write paths.
3. **OOB write** — netlink, USB, Bluetooth, NFC drivers; structured-fuzz
   with syzkaller.
4. **Race conditions** — userfaultfd, FUSE, `splice`, `pipe`. Win the race
   with userfaultfd page-faults to extend the window.
5. **Reference-counting bugs** — `refcount_t` underflow, `get_task_struct`
   forgotten on error path.
6. **eBPF abuse** — verifier bypass, helper return-value confusion, map
   spray for arbitrary read/write.
7. **Namespace escapes** — user-namespace + capability mismatch,
   `CAP_SYS_ADMIN` exposed inside container, shared kernel objects.
8. **Privileged file write** — overlayfs `redirect_dir`, copy_up race,
   `/proc/<pid>/setgroups` history.

## Recon
- `make menuconfig` → list enabled drivers (`CONFIG_*=y`).
- Diff against vendor kernel: `git log --oneline v6.1..stable` →
  unmerged security fixes are gold.
- Run `syzkaller` with `enable_syscalls` filtered to the new code surface.

## Building the exploit
1. **Triage primitive** — what does the bug give you? OOB-R, OOB-W, UAF,
   double-free, refcount underflow.
2. **Heap shape** — pick a victim object that overlaps the freed slab
   class. Common: `cred`, `tty_struct`, `seq_operations`, `pipe_buffer`,
   `msg_msg`.
3. **Spray** — `setxattr` (fine-grained), `msgsnd`/`msgrcv` (large), io_uring
   (fast).
4. **Pivot** — gain arbitrary read first, leak `kallsyms` / `modprobe_path`,
   then write `cred->uid = 0`.
5. **KASLR / SMEP / SMAP / KPTI bypass** — leak via prefetch side-channel
   (Spectre-PHT), or use a stack pivot inside the kernel's own code.

## Sanitisers
Build with `CONFIG_KASAN=y CONFIG_KFENCE=y CONFIG_UBSAN=y
CONFIG_KCSAN=y`. Reproduce every crash in qemu+gdb with
`-append "kasan.fault=panic"`.

## Reporting (kernel.org coordinated disclosure)
Email `security@kernel.org` with PGP-encrypted report; expect 7-day
embargo; CVE assigned by MITRE via Linux CNA. PoC must include kernel
config + qemu invocation.