A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets

Excellent article by Quang Le about exploiting CVE-2025-38617 — a race condition that leads to a use-after-free in the packet sockets implementation.

The implemented exploit was used to pwn the kernelCTF mitigation-v4-6.6 instance. The exploit bypasses CONFIG_RANDOM_KMALLOC_CACHES and CONFIG_SLAB_VIRTUAL.

Article: https://blog.calif.io/p/a-race-within-a-race-exploiting-cve
Exploit: https://github.com/google/security-research/pull/339

Analysis of Linux kernel bug fixes

Jenny Guanni Qu posted a detailed analysis of bug fixes in the Linux kernel:

— Kernel bugs hide for 2 years on average. Some hide for 20.

https://pebblebed.com/blog/kernel-bugs

— Who Writes the Bugs? A Deeper Look at 125,000 Kernel Vulnerabilities

https://pebblebed.com/blog/kernel-bugs-part2

setresuid(⚡): Glitching Google's TV Streamer from adb to root.

Talk by Niek Timmers about glitching the kernel of the Android-based Google TV Streamer device to escalate privileges via Electromagnetic Fault Injection.

The researcher glitched the setresuid syscall handler to bypass its checks and obtain the UID of 0. Bypassing SELinux via glitching remains to be investigated.

Video: https://www.youtube.com/watch?v=-w5mpXTnNJA
Slides: https://hardwear.io/netherlands-2025/presentation/Glitching-Googles-TV-Streamer-from-adb-to-root.pdf

[Cryptodev-linux] Page-level UAF exploitation

nasm_re posted an article about exploiting a page-level UAF in the out-of-tree cryptodev-linux driver. The researcher modified struct file sprayed into a freed page to escalate privileges.

https://nasm.re/posts/cryptodev-linux-vuln/

Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers

Talk by Xingyu Jin and Martijn Bogaard about a new type of logical bugs in kernel driver mmap handlers exploitable via the ptrace functionality.

Authors found multiple Android vendor drivers affected by the issue. They also wrote an exploit for the IMG DXT GPU driver to escalate privileges on Pixel 10.

Video: https://www.youtube.com/watch?v=yAUJFrPjfCI
Slides: https://powerofcommunity.net/2025/slide/x-84592.pdf

A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave

Article by @jenkins about exploiting a use-after-free in the driver for BigWave — an AV1 decoding hardware component present on Pixel SOCs.

Seth used the bug to escalate privileges from the mediacodec SELinux context and obtain root on Pixel 9.

This exploit is a part of an RCE chain developed by Seth and @natashenka.

Userspace part: https://projectzero.google/2026/01/pixel-0-click-part-1.html
Kernel part: https://projectzero.google/2026/01/pixel-0-click-part-2.html
Final part: https://projectzero.google/2026/01/pixel-0-click-part-3.html

Article series about exploiting CVE-2025-38352

@farazsth98 posted three articles about exploiting a race condition in the implementation of POSIX CPU timers.

Part 1️⃣ describes reproducing this race condition.

Part 2️⃣ explains how to extend the race window (a period of time when the race can be triggered).

Part 3️⃣ shows a complex PoC exploit for the UAF caused by this race condition.

Part 1: https://faith2dxy.xyz/2025-12-22/cve_2025_38352_analysis/
Part 2: https://faith2dxy.xyz/2025-12-24/cve_2025_38352_analysis_part_2/
Part 3: https://faith2dxy.xyz/2026-01-03/cve_2025_38352_analysis_part_3/

Dangling pointers, fragile memory — from an undisclosed vulnerability to Pixel 9 Pro privilege escalation

Article about analyzing and exploiting a race condition that leads to a double-free in the Arm Mali GPU driver.

https://dawnslab.jd.com/Pixel_9_Pro_EoP/

mediatek? more like media-rekt, amirite.

Article by @hypr covering an assortment of bugs the author found in the MediaTek MT76xx and MT7915 Wi-Fi drivers.

The article also describes the nonsensical responses MediaTek gave to the bug reports, seemingly trying to weasel out of assigning a High impact rating to the reported bugs.

https://blog.coffinsec.com/0days/2025/12/15/more-like-mediarekt-amirite.html

CVE-2025-68260: rust_binder: fix race condition on death_list

First CVE was registered for the new Binder kernel driver written in Rust. The vulnerability is a race condition caused by a list operation in an unsafe code block.

https://lore.kernel.org/linux-cve-announce/2025121614-CVE-2025-68260-558d@gregkh/T/#u