r/kernel

Hey everyone,

I graduated last year with a Bachelor's degree in Computer Science, and my current job requires me to port Ghostlock (CVE-2026-43499) to multiple android devices.

Honestly, a lot of it currently goes over my head. I think I understand the basic concept of a use-after-free vulnerability, but I don't understand how it works at the kernel level or how the exploit code actually works.

I'm also struggling to get the exploit working on my target device. Since I don't fully understand the exploit's internals or how the kernel processes the operations involved, I'm having a hard time figuring out what needs to be changed to make it work.

Here's what I have so far:

- Kernel panic logs from my attempts to run the exploit.

- The compiled kernel source code for my target device.

- The ability to modify the kernel source code and flash a custom kernel onto the device.

The problem is that I don't really know where to start. The kernel panic logs are difficult to understand, the exploit's source code is confusing, and navigating the relevant kernel code is equally challenging.

My current plan is to:

1. Learn how to interpret the kernel panic logs.

2. Understand the exploit's source code and how its different parts work.

3. Trace the relevant operations through the kernel source code to understand what's happening internally.

4. Use that understanding to troubleshoot the exploit and figure out what needs to change for my target device.

I'm not sure if this is the right approach or if I'm missing some important prerequisites.

For context, I'm still relatively new to low-level kernel exploitation, so I'm trying to figure out the best way to approach this without blindly changing things until they work.

For those experienced with Linux kernel exploitation or porting Android kernel exploits, how would you approach this problem? Are there any resources or concepts I should focus on first?

Any advice would be greatly appreciated!

Author here. This started as an experiment: can I run a real Linux glibc userspace on a stock, non-rooted Android phone without proot or a chroot?

Short answer: yes, by own-loading the guest libc into the same process as the bionic host and doing the dynamic linking myself. The interesting bugs were IFUNC/IRELATIVE resolution, the fact that the guest glibc malloc and the host bionic malloc share one brk (fixed with a private arena), static TLS + the thread pointer switch point, and Android's seccomp profile killing clone3 / close_range with SIGSYS instead of ENOSYS.

It runs python3, uv, gcc (compiling and running C inside the guest), git, gh, fzf, Node, tmux, and an interactive zsh with a starship prompt. No root, no namespaces, no ptrace.

What I'd most like feedback on: I only have a couple of devices, so the bugs left are the ones that appear on other phones. There are issue templates for bug reports and for "it works" reports — even "this ran fine on my Pixel" is useful.

Happy to answer anything about the loader.

Hey everyone, especially kernel/OS developers,

I had a weird thought and I'm curious how you'd approach it from a systems perspective:

If we imagined the human brain as a kernel, and neurons, brain regions, memory, sensory systems, etc. as kernel subsystems, what kind of kernel architecture would make the most sense? hybrid kernel microkernel or monolithic or something else?

So I have been working in the industry for around 2 years now. 1.5 years as an embedded firmware engineer and half a year as an embedded linux engineer at the same company(startup). Lately I have been working a lot with BSP and device driver development. I have noticed that Canonical has a junior linux kernel developer position open and I wanted to know is it smart to get into this field as a linux device driver developer and also to go work for a company like Canonical.

Hello,

I'd like to ask a question about network probing from a pod or service while the destination is Internet. If the packet reaches to the default gateway, it means there is no policy blocking it and connectivity is successful. How I can drop the packet that is generated in user space with DSCP value?

- What program can I use for this? Considering Cilium utilizes SNAT, how to make sure I can identify the source address of the packet?

For pod-to-pod traffic probing, I used cgroup/ingress to drop the packet if they reach destination pod. However, internet probing seems more complicated to me and I really need help/ideas.

Much appreciated and thanks in advance! :)