skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

exploiting-linux-kernel-vulnerabilities

Guides discovery and exploitation of Linux kernel memory-corruption bugs into privilege escalation primitives.

954|172|Updated Mar 13, 2026
Search Tags:#privilege-escalation#binary-exploitation#exploit-development#use-after-free#linux-kernel#kaslr-bypass#slab-grooming
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill exploiting-linux-kernel-vulnerabilities
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-linux-kernel-vulnerabilities
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/binary-exploitation/exploiting-linux-kernel-vulnerabilities
Command: npx skills add https://github.com/xalgord/xalgorix --skill exploiting-linux-kernel-vulnerabilities

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Kernel crash reports and KASAN splats do not prove exploitability, and turning a single UAF, OOB, or race bug into a stable privilege-escalation primitive requires navigating KASLR, SMEP, SMAP, KPTI, CFI, and unpredictable slab state. This Skill provides a structured methodology for confirming reachability, building arbitrary read/write primitives, and achieving ring-0 control during authorized kernel security assessments.

Core Features & Use Cases

  • Reachability and Triage: Verify whether an unprivileged process can reach vulnerable code via syscalls, ioctls, or sockets, and classify crashes as controllable UAF/OOB/race versus non-exploitable null derefs.
  • Primitive Construction: Convert weak bugs (1-byte reads, +N increments, freed objects) into arbitrary kernel read/write using slab grooming, buddy recycling, and heap sprays with msg_msg, sk_buff, and pipe_buffer objects.
  • Mitigation Bypass and Escalation: Leak kernel base via fixed-mapping IDT reads, then escalate through data-only cred overwrites, modprobe_path hijacking, or PTE forgery under SMEP/SMAP/KPTI/CFI.
  • Use Case: When assessing a target running a kernel affected by CVE-2025-38236 (AF_UNIX MSG_OOB UAF), follow the workflow to confirm reachability, build a repeatable read primitive, and demonstrate local privilege escalation with a documented finding report.

Quick Start

Ask the assistant to analyze a kernel crash or CVE on a target build and walk through confirming reachability, building a read/write primitive, and producing a structured exploitation finding report.

Frequently Asked Questions about exploiting-linux-kernel-vulnerabilities

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit a Linux kernel use-after-free vulnerability?▼

Exploit a kernel UAF by reallocating the freed object with attacker-controlled data using sprays of msg_msg, sk_buff, or pipe_buffer objects. First confirm the object is reclaimable, then corrupt a security-relevant field like a function pointer, length, or cred pointer to build read/write primitives.

How to bypass KASLR when exploiting the Linux kernel?▼

Bypass KASLR by leaking a fixed-mapping pointer such as the IDT descriptor at 0xfffffe0000000000 and subtracting the known handler offset to recover the kernel base. An arbitrary read primitive then lets you walk .data, vmemmap, and per-CPU regions to locate target structures.

Does kernel exploitation still work with SMEP, SMAP, KPTI, and CFI enabled?▼

Yes, but control-flow hijacking becomes impractical, so data-only attacks are preferred. Overwrite the current task's cred structure, modprobe_path, or core_pattern using an arbitrary write to gain root without executing injected code or violating CFI.

Why is my kernel heap spray unreliable for reclaiming freed objects?▼

Reclamation fails when slab grooming is skipped, because SLUB per-CPU freelists and freelist randomization make allocation order non-deterministic. Drain per-CPU freelists, spray at mass scale, and account for partial and page lists before expecting the freed object to return under your control.

How do I confirm a kernel bug is exploitable and not just a crash?▼

Confirm exploitability by running the target kernel under QEMU with KASAN and gdb, triggering the bug with a minimal C reproducer, then reallocating the object with marker bytes and reading them back through the primitive. If your markers appear, the primitive is real rather than a simple denial of service.

Related Skills

Explore More Software Engineering Skills→
RideMatch1RideMatch1

offensive-fuzzing

Identify vulnerabilities in targets through structured fuzzing workflows.

Community
Advanced
ElbertePlinioElbertePlinio

vulnerability-validation

Validate code scan findings and generate structured JSON with exploitability details.

Community
Intermediate
1k-off1k-off
1

android-tombstone-symbolication

Resolve .NET runtime native frames in Android tombstones using BuildIds and llvm-symbolizer.

Community
Advanced
yhy0yhy0
74

pentest-memory-corruption

Identify and guide exploitation of memory corruption vulnerabilities in native applications.

Community
Advanced