A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets
A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic.
My Feed
CVE-2025-38352 (Part 3) - Uncovering Chronomaly
Walking through the exploit development process of the Chronomaly exploit for CVE-2025-38352.
CVE-2025-38352 (Part 2) - Extending The Race Window Without a Kernel Patch
Improving the PoC from the part 1 by extending the race window from userland.
CVE-2025-38352 (Part 1) - In-the-wild Android Kernel Vulnerability Analysis + PoC
Analyzing and writing a PoC for CVE-2025-38352.
100+ Kernel Bugs in 30 Days
We used AI agents to reverse engineer Windows kernel drivers to find zero-days. It worked better than expected. Which is bad.
Reversing CVE-2026-21241 - Use After Free in AFD.sys
When Good /bins Go Bad
A Remote Pre-Authentication Overflow in LLDB's debugserver
Objective-See: ClickFix: Stopped at ⌘+V
Defending against malicious terminal pastes
Cross Cache Attack CheatSheet
Cross-cache attacks are highly powerful in Linux kernel exploitation because they can transfer a UAF from one object to another, even if the other object is allocated from a different slab.
Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch - Theori BLOG
A new approach to the Overwriting modprobe_path technique is introduced, addressing changes in the Upstream kernel that prevent triggering via dummy files. | Vulnerability Research
Linux Kernel Exploitation - PageJack
In this post, I will explain PageJack, a universal and data-only exploitation technique that turns an off-by-one bug into a page UAF. Download the handouts beforehand.
Linux Kernel Exploitation - USMA
In this post, I will explain USMA, a universal and data-only exploitation technique that allows us to patch kernel code from user space. Download the handouts beforehand.
Linux Kernel Exploitation - Dirty Pipe
In this post, I will explain Dirty Pipe, a universal and data-only exploitation technique that allows us to arbitrarily overwrite read-only files. Download the handouts beforehand.
Linux Kernel Exploitation - DirtyCred
In this post, I will explain DirtyCred, a universal and data-only exploitation technique that allows us to escalate privileges without a write primitive. Download the handouts beforehand.
Linux Kernel Exploitation - Dirty PageTable
In this post, I will explain Dirty PageTable, a universal and data-only exploitation technique that allows us to gain arbitrary read and write access to the entire physical memory. Download the handouts beforehand.