https://algoatson.github.io/series/linux-kernel-exploitation/ Most kernel mitigations watch for corrupted pointers and hijacked control flow. DirtyCred sidesteps all of it — instead of overwriting bytes inside a cred or file, it frees the whole privileged object and lets a legitimate one take its place. A UAF becomes root with no leak, no ROP, and nothing for CFI to catch. en Tue, 16 Jun 2026 02:47:52 +0000 https://algoatson.github.io/p/slab-uaf-modprobe/ https://algoatson.github.io/p/slab-uaf-modprobe/ Sat, 14 Feb 2026 00:00:00 +0000 kernelpwnlinux A toy char driver frees an object and keeps the pointer. From there it's the usual kernel kata — reclaim the slot with a spray, leak KASLR through the dangling read, then turn the dangling write into a modprobe_path overwrite. https://algoatson.github.io/p/kernel-lpe-commit-creds/ https://algoatson.github.io/p/kernel-lpe-commit-creds/ Sun, 12 Apr 2026 00:00:00 +0000 kernelpwn The data-only path overwrites modprobe_path; the code path hijacks kernel control flow to run commit_creds(prepare_kernel_cred(0)) and returns to a root shell. Here's that path, and the four mitigations — SMEP, SMAP, KPTI, KASLR — you step over to walk it. https://algoatson.github.io/p/userfaultfd-fuse-race-windows/ https://algoatson.github.io/p/userfaultfd-fuse-race-windows/ Mon, 20 Apr 2026 00:00:00 +0000 kernelpwn A UAF that needs you to reallocate in a microsecond window is a coin flip — unless you can pause the kernel mid-copy. userfaultfd (and FUSE, when it's locked down) let a page fault block in your own handler, stretching a hopeless race into a step you control. https://algoatson.github.io/p/dirty-pipe-cve-2022-0847/ https://algoatson.github.io/p/dirty-pipe-cve-2022-0847/ Wed, 03 Jun 2026 00:00:00 +0000 kernelpwn A pipe buffer's flags field was left uninitialised, so a stale PIPE_BUF_FLAG_CAN_MERGE let a write() spill into the page cache of a file you only opened read-only. No memory corruption, no ROP — just a missing assignment that turns "read a file" into "overwrite it". A source review of one of the cleanest LPEs in years. https://algoatson.github.io/p/kernel-heap-spray-primitives/ https://algoatson.github.io/p/kernel-heap-spray-primitives/ Tue, 14 Apr 2026 00:00:00 +0000 kernelpwn A kernel UAF is only useful if you can land controlled data in the freed slot. The exploit-dev toolkit is a handful of syscalls that allocate kernel objects of a size and content you choose — msg_msg, setxattr, add_key, sk_buff — each with different lifetime and reach across the SLUB caches. https://algoatson.github.io/p/cross-cache-attacks/ https://algoatson.github.io/p/cross-cache-attacks/ Thu, 16 Apr 2026 00:00:00 +0000 kernelpwn The juicy kernel structs — cred, file, task_struct — live in dedicated caches a kmalloc spray can't touch. Cross-cache attacks free the victim's whole slab page back to the buddy allocator and let a different cache claim it, so two object types overlap on the same physical page. The trick that turns a UAF in one cache into a bug affecting another. https://algoatson.github.io/p/dirtycred-swapping-credentials/ https://algoatson.github.io/p/dirtycred-swapping-credentials/ Sat, 18 Apr 2026 00:00:00 +0000 kernelpwn Most kernel mitigations watch for corrupted pointers and hijacked control flow. DirtyCred sidesteps all of it — instead of overwriting bytes inside a cred or file, it frees the whole privileged object and lets a legitimate one take its place. A UAF becomes root with no leak, no ROP, and nothing for CFI to catch.