Linux Kernel Exploitation Notes

Notes on Linux kernel internals and exploitation techniques, written as I research and study each topic. Covers subsystem internals, memory management, modern attack primitives, and exploitation strategies used in CTF and real-world exploit development.

Topics

├── Internals/
│   ├── How Syscalls Work?
│   ├── Kernel Module Internals
│   ├── Namespaces-Cgroups-Capabilities
│   ├── Virtual File System
│   └── MM/
│       ├── Buddy Allocator
│       ├── How Google Mitigates Cross-Cache Attacks?
│       ├── How page fault is handled?
│       ├── Linux SLUB Allocator
│       ├── Page Cache
│       └── What if a process could "mov cr3, 0xdeadface"?
├── Race Conditions/
│   ├── FUSE - Filesystem in Userspace
│   ├── Hole Punching - dev-shm
│   ├── Userfaultfd
│   └── timerfd-epoll
├── Heap Spraying/
│   ├── msg_msg
│   ├── pipe_buffer
│   ├── seq_file
│   ├── setxattr
│   ├── sockets
│   ├── timerfd_ctx
│   └── tty_struct
├── Cross-Cache Attacks/
│   ├── Dirty Creds
│   ├── Dirty File
│   ├── Dirty Page
│   ├── PCPLost - PCP Massaging
│   └── PMD Overwrite
├── KROP/
│   ├── Aarch ROP
│   ├── RetSpill
│   ├── RopBot / Angrop
│   └── x86 ROP
├── Targets/
│   ├── Commit Creds
│   ├── core_pattern
│   └── modprobe_path
└── Misc/
    └── Misc