Bypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL
Talkat Linux Security Summit North America 2025 · on Thursday, 2025-06-26· at 13:40· Bluebird Ballroom (BBB) 3GH·
summary
Builds Linux as a user-space library (LKL) and hooks it to libFuzzer + KSAN to run fast, coverage-guided kernel fuzzers without VMs or hardware. Adds MMU emulation, a deterministic scheduler, and PCI/virtio hooks; binaries with coverage instrumentation grow but still run (example: ~15 MB without full coverage, larger with line info). Fuzzers target USB HID (issues validated on real devices via FaceDancer, coverage ~80% in CI), Android binder (coverage raised to ~68%, two exploitable bugs found), and virtio frontends that produced a real out‑of‑bounds bug.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:54Linux Kernel Library benefits
- 7:11Fuzzing with LKL and tooling
- 13:52Air fuzzers overview
- 17:45HID fuzzer demo and debugging
- 22:27Binder driver fuzzing challenges
- 32:22Virtio drivers in Android PKVM
- 39:03Key learnings and future work
- 41:21Q&A
related talks
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
26mFuzzing Host-to Guest Attack Surface in Android Protected KVM
28mkAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
39mFuzzing the Native NTFS Read-Write Driver (NTFS3) in the Linux Kernel
50mWhat the Fuzz
39mMaking Fuzzing Part of Your Software Development Lifecycle
24mDesigning UAPI for Fuzz-ability
29mVirtual Device Fuzzing Support in QEMU