feiguang-ai / plz110-6.12.69-cve-2026-64560-ksu

一加 15T（PLZ110）临时 root + KernelSU per-boot 接管：CVE-2026-64560 移植，不写分区、重启即失效。内核 6.12.69-android16-6-g242e1a07f878。

xairy / linux-kernel-exploitation

A collection of links related to Linux kernel security and exploitation

The-Z-Labs / linux-exploit-suggester

Linux privilege escalation auditing tool

mito753 / Kernel-Exploit-Dojo

CTF kernel exploitation notes, PoCs, exploits, and writeups.

bcoles / kasld

KASLD defeats Linux kernel KASLR from a local process — recovering the virtual and physical memory layout where a leak or side channel allows, and narrowing it to the smallest set of placements the evidence supports otherwise.

DeathShotXD / 0xM0nCrush

Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.

jedharveycambel18-arch / gecko-tcp-bridge

Best Wii U TCP Gecko Homebrew Modding Engine Guide 2026

DeathShotXD / 0xCr0ssCrush

Windows BYOVD research on DCRCVDrv.sys and Alinubx.sys, reverse engineering their kernel primitives, IOCTL surfaces, and detection opportunities.

armourinfosec / Offensive-Linux-Privilege-Escalation

Offensive Linux Privilege Escalation — hands-on study notes: enumeration, sudo/SUID/capabilities, cron & systemd timers, kernel LPEs (DirtyPipe/OverlayFS/PwnKit), container & namespace escapes, and credential mining. Each technique with detection & defenses. CC BY 4.0.

security-attack / RingKiller

RingKiller — BYOD PoC for vulnerable driver DCRCVDrv.sys. Abuses IOCTL 0x2205C0 to kill arbitrary processes from ring 0 via ZwTerminateProcess. EDR/AV termination primitive. Lab only.

ZeroDayEvil / CVE-2026-31431

🛡️ Official AI Security Tool module for CVE-2026-31431 ("Copy Fail" / Linux algif_aead page-cache scratch-write LPE Exploit & Detector).