Linux kernel exploits

TL;DR: Public kernel PoCs are last-resort: match the exact kernel version, distro patchset, and config carefully, test offline, and accept that they crash boxes when they fail.

What it is

A kernel exploit abuses a bug in the Linux kernel itself (memory-safety, race, logic) to elevate from an unprivileged user (or container) to UID 0 in the host kernel. Because the kernel is the trust root, success is total — but failure usually panics the box, making this the noisiest privesc class.

Preconditions / where it applies

Local code execution on a Linux host or container
Kernel version + distro that actually maps to a public PoC’s vulnerable range
Required kernel features compiled in (e.g. CONFIG_USER_NS=y for many recent bugs, nft_* for nftables UAFs)
No mitigations that defeat the specific PoC (KASLR, SMEP/SMAP, KPTI, CFI, LKRG, modern Linux Kernel Runtime Guard rules)

Technique

Fingerprint first — never run a PoC blind:

  
uname -a
cat /etc/os-release
cat /proc/version
cat /proc/config.gz 2>/dev/null | gunzip
zcat /boot/config-$(uname -r) 2>/dev/null
sysctl kernel.unprivileged_userns_clone kernel.dmesg_restrict

Map to candidates. Tools that map fingerprint → PoC list:

linux-exploit-suggester.sh (jondonas/linux-exploit-suggester)
linux-exploit-suggester-2.pl
linpeas.sh (kernel section)
Manual cross-check against the Ubuntu/Debian/RHEL changelog — distro backports often patch the bug while leaving the version string vulnerable-looking.

Recent high-impact CVEs worth knowing:

CVE	Bug class	Range
CVE-2022-0847 (Dirty Pipe)	pipe ring-buffer flag init	5.8–5.16.10
CVE-2022-2588 (cls_route)	UAF in net scheduler	<= 5.18
CVE-2023-3390 (nf_tables)	UAF in nftables	<= 6.4
CVE-2023-32233 (Netfilter)	UAF in nf_tables anonymous sets	<= 6.3.1
CVE-2024-1086 (nf_tables)	double-free in nft_verdict_init	<= 6.8
CVE-2022-32250	UAF in netfilter	<= 5.18.1

Run discipline: copy the PoC to a tmpfs, compile statically where possible, take a snapshot or have console access to the host before triggering. PoCs frequently leave the kernel in a degraded state even on success.

gcc -static -o /dev/shm/poc poc.c
/dev/shm/poc

Detection and defence

Patch promptly; subscribe to USN/DSA/RHSA
sysctl kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) and user.max_user_namespaces=0 defeat a wide swath of recent bugs
Lockdown LSM, SELinux/AppArmor, seccomp filters in container runtimes
KASLR + KPTI + SMEP/SMAP on by default; check dmesg | grep -i 'smep\|smap\|kaslr'
Auditd / eBPF detections on suspicious unshare(CLONE_NEWUSER), setns, bpf(), nft_* syscall patterns
Kernel panics in syslog plus sudden privilege jumps are the most reliable IOC

References

Linux Exploit Suggester — version-based PoC mapper
HackTricks — Linux Privesc Kernel Exploits — overview and gotchas
grsecurity — Linux Kernel Hardening notes — defence-in-depth context