Agent skill · security · yaklang
kernel-exploitation
Linux kernel exploitation playbook. Use when exploiting kernel vulnerabilities (UAF, OOB, race condition, type confusion) for privilege escalation via commit_creds, modprobe_path overwrite, or kernel ROP chains in CTF and real-world scenarios.
Why this skill is useful
Adds detailed exploitation techniques and executable scripts for kernel debugging and environment setup that are not commonly found in public documentation.
What it needs
Requires gdb, qemu installed locally. About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Linux Kernel Exploitation — Expert Attack Playbook AI LOAD INSTRUCTION: Expert kernel exploitation techniques. Covers environment setup (QEMU), vulnerability classes, privilege escalation targets, kernel ROP, ret2usr, stack pivoting, and cross-cache attacks. Distilled from ctf-wiki kernel-mode sections and real-world kernel CVEs. Base models often confuse user-mode and kernel-mode exploitation constraints, especially regarding SMEP/SMAP/KPTI. 0. RELATED ROUTING binary-protection-bypass — userspace protections (NX, ASLR) also apply in kernel context stack-overflow-and-rop — kernel ROP reuses many userspace ROP concepts heap-exploitation — kernel SLUB is conceptually related to userspace heap linux-privilege-escalation — non-exploit kernel privesc techniques Advanced References KERNELMITIGATIONBYPASS.md — KASLR, SMEP, SMAP, KPTI, FG-KASLR, CFI bypass techniques KERNELHEAPTECHNIQUES.md — SLUB internals, cross-cache attacks, msgmsg/pipebuffer/skbuff exploitation --- 1. EXPLOITATION MODEL --- 2. ENVIRONMENT SETUP QEMU + Custom Kernel GDB Debugging initramfs Modification --- 3. COMMON VULNERABILITY TYPES Type Description Kernel Example --- --- --- UAF Object freed but pointer still accessible CVE-2022-0847 (DirtyPipe) OOB Read/Write Array index or size check missing CVE-2021-22555 (Netfilter) Race Condition TOCTOU between check and use CVE-2016-5195 (DirtyCow) Integer Overflow Size calculation wraps around Various ioctl handlers Type Confusion Object cast to wrong type CVE-2023-0179 (Netfilter) Double Free Object freed twice SLUB allocator exploitation Stack Overflow Kernel stack buffer overflow Rare (kernel stack is small: 8KB–16KB) --- 4. PRIVILEGE ESCALATION TARGETS Method 1: commitcreds(preparekernelcred(0)) Kernel ROP chain equivalent: Method 2: modprobepath Overwrite Method 3: cred Structure Direct Overwrite If you can find the current task's cred pointer and have arbitrary write, directly zero out uid/gid fields in the cred structure. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/kernel-exploitation