# Exploiting Linux Kernel Vulnerabilities

Methodology for discovering and exploiting Linux kernel memory-corruption...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill exploiting-linux-kernel-vulnerabilities -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill exploiting-linux-kernel-vulnerabilities -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill exploiting-linux-kernel-vulnerabilities -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill exploiting-linux-kernel-vulnerabilities -g -a gemini-cli -y`

## Description

Methodology for discovering and exploiting Linux kernel memory-corruption vulnerabilities (UAF, OOB read/write, race/TOCTOU, type confusion) during authorized engagements, covering reachability analysis, building stable read/write primitives from a single bug, defeating KASLR/SMEP/SMAP/KPTI, slab/buddy heap grooming, and pivoting to ring-0 code execution or credential overwrite for local privilege escalation.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Exploiting Linux Kernel Vulnerabilities

## When to Use

- During authorized kernel security assessments, local privilege-escalation (LPE) research, or sandbox-escape work where
  unprivileged userland can reach kernel code through a syscall, ioctl, socket family, netlink, or a vulnerable driver.
- When triaging a kernel crash (`Oops`, `KASAN` splat, `GENERAL PROTECTION fault`, `BUG: KASAN: use-after-free`) and you
  need to determine whether the bug is a controllable UAF, OOB, double-free, or race rather than a pure null-deref DoS.
- When a recent CVE (e.g., AF_UNIX `MSG_OOB` UAF / CVE-2025-38236, POSIX CPU-timers TOCTOU / CVE-2025-38352, ksmbd
  OOB write / CVE-2025-37947) is in scope and you must confirm reachability and exploitability on the target build.
- As the methodology that turns a weak kernel primitive (a 1-byte read, a `+N` increment, a single freed object) into
  full kernel read/write/execute.

## Critical: Concepts/Steps Most Often Missed

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/binary-exploitation/exploiting-linux-kernel-vulnerabilities/SKILL.md