Linux Security Summit North America 2026
2026-05-21..2026-05-22
Minneapolis, United States
[Linux Security Summit North America 2018, Linux Security Summit North America 2019, Linux Security Summit North America 2020, Linux Security Summit North America 2022, Linux Security Summit North America 2023, Linux Security Summit North America 2024, Linux Security Summit North America 2025, Linux Security Summit North America 2026]
who it's for
linux kernel developers, lsm developers, security engineers, distribution maintainers, container and runtime developers, cryptography engineers, hardware and firmware engineers, application sandboxing engineers
topics
secure hibernation with TPM PCR; container ptrace perf eBPF abuses; PAC BTI GCS on AArch64; Intel CET shadow stacks and IBT; reproducible bootstrapped builds; kernel cryptography library APIs; Hornet LSM eBPF signature verification; AppArmor FD object delegation; exporting audit to BPF via kfuncs; kernel vulnerability triage and CVEs; function-level code metrics for kernel
| title | author | length |
|---|---|---|
| Welcome & Opening Remarks | James Morris | 03m |
Conference opens noting three or four talks canceled due to visa, travel budget, and illness, but the schedule still has focused technical sessions and this… | ||
| Secure Hibernation in a Locked Down World | Matthew Garrett | 37m |
Lockdown LSM currently disables hibernation because a tampered hibernation image can load an attacker kernel; the patchset generates a TPM key in-kernel tied… | ||
| Container Escape Paths Nobody Monitors: Abusing Linux Debug Interfaces | Nikunj Doshi | 32m |
Demonstrations show ptrace, perf and eBPF can be abused from inside containers to read memory, inject code, load kernel hooks and persist via eBPF rootkits… | ||
| Defending the Branch: PAC, BTI & GCS on Linux | Bill Roberts | 42m |
ARM AArch64 defenses are deployable now but require concrete changes: PAC signs LR using A/B keys and must be encoded in DWARF/CFI so unwinding can demangle… | ||
| A Technical Deep Dive Into Intel CET Implementation in Linux | Jay Tharwani | 29m |
Detailed Linux kernel plumbing for Intel CET: IBT enforces forward-edge targets with the ENDBR opcode and a sealed IBT table (merged in Linux 5.18), while… | ||
| StageX: Rebuilding Trust Through Multi-Signed, Full-Source Bootstrapped, and Reproducible Builds | Danny Grove, Lance Vick | 20m |
StageX rebuilds distribution trust by requiring bit-for-bit reproducible builds that are bootstrapped from 181 bytes of machine code and released only after a… | ||
| Modernizing Kernel Cryptography: From Complex APIs To Streamlined Libraries | Eric Biggers | 28m |
The kernel adds straightforward library functions (first set landed in 6.17) that replace the traditional crypto API for common one‑shot and incremental ops… | ||
| Welcome Back & Remarks | James Morris | 02m |
Day two starts with notes about cancelled slots and an added wait-listed speaker, then a decision to extend the successful bird of a feather (BoF) into more… | ||
| Hornet LSM | Blaise Boscaccy | 26m |
Hornet LSM verifies signed eBPF artifacts and emits machine-readable integrity verdicts to other LSMs, hooking BPF_PROG_LOAD and parsing PKCS7 attributes to… | ||
| Bringing Object Delegation To AppArmor | John Johansen | 38m |
Adds FD-based object delegation to AppArmor that delegates individual open file descriptors (inheritance and SCM_RIGHTS) using a secondary state-machine… | ||
| CrackAppArmor Retrospective | John Johansen | 35m |
Nine vulnerabilities producing 11 CVEs include a confused‑deputy LPE via the policy management interface CVE 202623268, a sudo-assisted escalation path, a… | ||
| Bridging BPF LSM and the Linux Audit Subsystem | Frederick Lawler | 24m |
Claim: export audit functionality to BPF via kfuncs so BPF LSMs can emit formal audit records. Implementation: patch series breaks the LSM audit API into… | ||
| Exploring Function-Level Code Metrics and Developer Attributes for Linux Kernel Vulnerabilities | Yan Sun | 17m |
Dataset covers about 11,000 kernel CVEs and roughly 8,700 VFC‑VIC pairs collected from NVD and upstream patches. Analysis finds that authors of VICs have lower… | ||
| nothing matches | ||