# Kernel Exploitation

Linux kernel exploitation playbook.

- Repository: https://github.com/Zyrexnn/Cybermes (987 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Zyrexnn/Cybermes --skill kernel-exploitation -g -a claude-code -y`
Codex: `npx skills add Zyrexnn/Cybermes --skill kernel-exploitation -g -a codex -y`
Cursor: `npx skills add Zyrexnn/Cybermes --skill kernel-exploitation -g -a cursor -y`
Gemini CLI: `npx skills add Zyrexnn/Cybermes --skill kernel-exploitation -g -a gemini-cli -y`

## Description

Linux kernel exploitation playbook. Use when exploiting kernel vulnerabilities (UAF, OOB, race condition, type confusion) for privilege escalation via commit_creds, modprobe_path overwrite, or kernel ROP chains in CTF and real-world scenarios.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# SKILL: Linux Kernel Exploitation, Expert Attack Playbook

> **AI LOAD INSTRUCTION**: Expert kernel exploitation techniques. Covers environment setup (QEMU), vulnerability classes, privilege escalation targets, kernel ROP, ret2usr, stack pivoting, and cross-cache attacks. Distilled from ctf-wiki kernel-mode sections and real-world kernel CVEs. Base models often confuse user-mode and kernel-mode exploitation constraints, especially regarding SMEP/SMAP/KPTI.

## 0. RELATED ROUTING

- [binary-protection-bypass](../binary-protection-bypass/SKILL.md), userspace protections (NX, ASLR) also apply in kernel context
- [stack-overflow-and-rop](../stack-overflow-and-rop/SKILL.md), kernel ROP reuses many userspace ROP concepts
- [heap-exploitation](../heap-exploitation/SKILL.md), kernel SLUB is conceptually related to userspace heap
- [linux-privilege-escalation](../linux-privilege-escalation/SKILL.md), non-exploit kernel privesc techniques

### Advanced References

- [KERNEL_MITIGATION_BYPASS.md](./KERNEL_MITIGATION_BYPASS.md), KASLR, SMEP, SMAP, KPTI, FG-KASLR, CFI bypass techniques
- [KERNEL_HEAP_TECHNIQUES.md](./KERNEL_HEAP_TECHNIQUES.md), SLUB internals, cross-cache attacks, msg_msg/pipe_buffer/sk_buff exploitation

---

## 1. EXPLOITATION MODEL

The rest: https://github.com/Zyrexnn/Cybermes/blob/HEAD/knowledge/hack-skills/skills/kernel-exploitation/SKILL.md