Exploiting the Linux Kernel

Instructor:  Andrey Konovalov
Dates:  June 15 to 18 2026
Capacity:  20

A 4-day Linux kernel exploitation frenzy!

This training guides researchers through the field of Linux kernel exploitation. In a series of practical labs, the training explores the process of exploiting kernel bugs in a modern Linux distribution on the x86-64 architecture.

The training is structured as a series of lectures, each followed by one or more hands-on labs. The goal of each lab is to write a Linux kernel exploit following the techniques described during the lecture.

The training starts with beginner topics but proceeds into advanced areas as well. The beginner chapters include learning how to escalate privileges and bypass foundational mitigations in x86-64 kernels. The advanced chapters are primarily dedicated to the modern Slab (heap) exploitation techniques and include an in-depth analysis of the kernel allocators' internals.

The core requirement for this training is the ability to read and write C code. Basic knowledge of the x86-64 architecture and assembly, GDB, and the common binary exploitation techniques would also come in handy. There is no need to know any Linux kernel internals: all required parts are covered during the training.

Course Agenda

Day 1 — Internals and exploitation basics

• Internals and debugging: x86-64 architecture refresher; security-relevant Linux kernel internals and attack surface; types of kernel vulnerabilities; setting up kernel debugging environment with VMware; using GDB to debug kernel and its modules
• Escalating privileges: ret2usr, overwriting cred structure, overwriting modprobe_path; control flow hijacking and arbitrary address read/write primitives

Day 2 — Mitigation bypasses and basic Slab exploitation

• Bypassing mitigations: KASLR, SMEP, SMAP, and KPTI internals and bypass techniques; in-kernel Return-Oriented Programming (ROP)
• Exploiting Slab corruptions: in-depth SLUB internals; exploiting Slab out-of-bounds and use-after-free vulnerabilities; Slab-specific mitigations; data-only exploitation techniques

Day 3 — Classic Slab exploitation

• Exploiting more Slab corruptions: cache merging and accounting; hardened usercopy; elastic objects; msg_msg and pipe_buffer–based exploitation techniques
• Writing end-to-end exploit for N-day kernel vulnerability

Day 4 — Modern Slab exploitation

• Userfaultfd and FUSE; related exploitation techniques
• Cross-cache and cross-allocator attacks
• Learning more advanced exploitation techniques; applicability of covered techniques to Android kernels; useful references

Stretch content

(covered on last day if have time left over, self-study otherwise):

• Page table–based exploitation techniques
• Writing end-to-end exploit for another N-day kernel vulnerability

Requirements

Hardware requirements:

• x86-64–based machine
• At least 100 GB of free disk space
• At least 16 GB of RAM
• Ability to plug in an untrusted USB drive (relevant for corporate laptops)

Software requirements:

• Host OS: Linux (recommended) or Windows
• VMware Workstation Player or Pro
• 7-Zip

Prerequisites:

• Working C knowledge
• Familiarity with x86-64 architecture and x86-64 assembly
• Familiarity with GDB
• Familiarity with common types of vulnerabilities and exploitation techniques for userspace applications
• No knowledge about Linux kernel internals is required

Learning Objectives

• Security-relevant Linux kernel internals and attack surface
• Kernel privilege escalation techniques
• Exploiting vulnerabilities in stack, global, and Slab (heap) memory
• Exploiting use-after-free and out-of-bounds vulnerabilities
• KASLR, SMEP, SMAP, and KPTI bypasses
• In-kernel Return-Oriented Programming (ROP)
• Data-only kernel exploitation techniques
• Cross-cache and cross-allocator attacks
• Page table–based exploitation techniques

Who Should Attend

The training is aimed at security researchers or software engineers desiring to enter or progress in the field of Linux kernel security.

BIO

Andrey Konovalov is a security researcher focusing on the Linux kernel.

Andrey found multiple zero-day bugs in the Linux kernel and published proof-of-concept exploits for these bugs to demonstrate the impact. Andrey contributed to several security-related Linux kernel subsystems and tools: KASAN — a fast dynamic bug detector; syzkaller — a widely-used kernel fuzzer; and Arm Memory Tagging Extension (MTE) — an exploit mitigation.

Andrey gave talks at many security conferences such as OffensiveCon, Zer0Con, Android Security Symposium, and Linux Security Summit. Andrey also maintains a collection of Linux kernel security–related materials and a channel on Linux kernel security.

See xairy.io for all of Andrey's articles, talks, and projects.

To Register

Click here to register.