Exploit Development546 A data-only technique that hijacks the x64 Interrupt Descriptor Table (IDT) to achieve kernel code execution on a fully hardened Windows 11…
Containers557 A deep technical walkthrough of ipv6_frag_escape, a public proof-of-concept exploit that converts a Linux kernel IPv6 fragmentation linear overflow into a reliable…
kernel452 A deep technical walkthrough of how Windows on ARM (WoA) discovers, initializes and dispatches interrupts through the Generic Interrupt Controller (GIC) —…
Exploit Development490 CVE-2026-40369 is an unprivileged arbitrary 12-byte kernel write in nt!ExpGetProcessInformation, reachable from Chrome/Edge/Firefox renderer sandboxes via NtQuerySystemInformation. A walk through the unchecked…
Exploit Development450 CVE-2018-8611 is a race-condition LPE in the Windows Kernel Transaction Manager (KTM), originally caught in the wild by Kaspersky’s AEP in October…
Exploit Development498 CVE-2024-1065 is a physical-page use-after-free in the ARM Mali GPU kernel driver. Because the freed page lands in MIGRATE_MOVABLE, Dirty Pagetable and…
Exploit Development451 CVE-2021-1732 is a Win32k local privilege escalation in win32kfull.sys. By flipping the 0x800 bit on tagWND with NtUserConsoleControl and returning a fake…
kernel702 A defender-side surface map of Windows kernel/user-mode covert channels — mailslots and ALPC, firmware-table providers and WNF, dispatch tables and writable .data…
kernel369 Walk-through of Lukas Maar’s page-level use-after-free in the Linux kernel’s QAIC (Qualcomm AI Accelerator) DRM driver: the missing VMA boundary check in…
kernel353 A walk-through of zolutal’s revival of the 2017 Project Zero “native_write_cr4” trick on a modern Linux kernel with CR Pinning enabled. The…
Exploit Development487 CVE-2026-40369 is a Windows kernel bug in "nt!ExpGetProcessInformation" that lets any unprivileged process — including one inside Chrome’s renderer sandbox — increment…
Escalation340 A full walkthrough of CVE-2024-27398, a race-induced use-after-free in the Linux 6.8 Bluetooth SCO subsystem. The exploit races two connect() threads on…
