https://netacoding.com/tags/linux-kernel-exploit/ Recent content in Linux-Kernel-Exploit on Netacoding | Cybersecurity, Assembly & Network Research https://netacoding.com/img/logo-netacoding.png https://netacoding.com/img/logo-netacoding.png Hugo en-us Wed, 29 Apr 2026 00:00:00 +0000 https://netacoding.com/posts/fuse-boundary-mathematics-pgoff-overflow/ Wed, 29 Apr 2026 00:00:00 +0000 https://netacoding.com/posts/fuse-boundary-mathematics-pgoff-overflow/ FUSE daemon controls i_size — setting it to 0xFFFFFFFFFFFFFFFF wraps pgoff_t arithmetic in mm/filemap.c and mm/mmap.c, inverting page cache loop invariants and turning vma_merge() into an OOB-write primitive on Maple Tree-backed kernels (5.15+). https://netacoding.com/posts/fuse-async-abort-race-double-put/ Wed, 29 Apr 2026 00:00:00 +0000 https://netacoding.com/posts/fuse-async-abort-race-double-put/ fuse_req borrows inode references without incrementing i_count. A three-actor race between SIGKILL, drop_caches inode eviction, and delayed fuse_abort_conn teardown yields a refcount decrement on freed SLUB slab memory — DirtyCred-class struct cred UAF in three syscalls. https://netacoding.com/posts/fuse-trust-boundary-and-size-desync/ Wed, 29 Apr 2026 00:00:00 +0000 https://netacoding.com/posts/fuse-trust-boundary-and-size-desync/ An unprivileged FUSE daemon holds semantic authority over i_size — lying in vfs_getattr responses desynchronizes kernel allocation size from ingestion size in kernel_read_file(). finit_module(2), the firmware loader, and kexec_file_load(2) become kmalloc-4k slab overflow primitives. Full VFS trust boundary analysis and virtio-fs attack surface.