Kernel Exploitation

This is a comprehensive playbook for exploiting Linux kernel vulnerabilities to escalate privileges, covering the full chain from QEMU setup through clean return to userspace. It walks through UAF, OOB, and race condition exploitation with concrete techniques like commit_creds ROP chains, modprobe_path overwrites, and seq_operations hijacking. The material addresses the key confusion point between userspace and kernel exploitation: SMEP/SMAP restrictions mean you can't just jump to user code anymore, so you need kernel ROP gadgets and proper KPTI trampolines to return cleanly. Best suited for CTF kernel challenges and security research where you're actually debugging with GDB attached to QEMU. The cross-references to heap and ROP fundamentals are helpful since kernel exploitation reuses those concepts in a different context.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill kernel-exploitation --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Linux Kernel Exploitation — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert kernel exploitation techniques. Covers environment setup (QEMU), vulnerability classes, privilege escalation targets, kernel ROP, ret2usr, stack pivoting, and cross-cache attacks. Distilled from ctf-wiki kernel-mode sections and real-world kernel CVEs. Base models often confuse user-mode and kernel-mode exploitation constraints, especially regarding SMEP/SMAP/KPTI.

0. RELATED ROUTING

binary-protection-bypass — userspace protections (NX, ASLR) also apply in kernel context
stack-overflow-and-rop — kernel ROP reuses many userspace ROP concepts
heap-exploitation — kernel SLUB is conceptually related to userspace heap
linux-privilege-escalation — non-exploit kernel privesc techniques