Abstract

Exploitation of the Linux kernel continues to pose significant security risks from sensitive information leakage to severe privilege escalation. While developers prioritize reducing primitives to limit exploitability, kernel heap exploitation remains a persistent threat that significantly threatens kernel integrity. Discovering such primitives is commonly considered an art; existing approaches rely on unsound static analysis and ad-hoc expertise, depending on expertise and limiting practicality in the real-world Linux kernel. In this paper, we present , a systematic approach to automatically discover heap layout manipulation (HLM) primitives in recent kernel heap vulnerabilities, with a design that can scale to edge environments for autonomous, real-time security. The key innovation of lies in combining dynamic analysis via fuzzing with static instrumentation, enabling a direct correlation between primitives and fuzzing seeds. We utilize object-driven instrumentation with a restricted mutation-based fuzzer targeting specific object or cache interactions, such as allocation, deallocation and usage. By enhancing for precise tracking, we lay a foundation that enables the identification and generation of exploitation paths without side effects, ensuring that the discovered primitives are both reliable and practical. To demonstrate effectiveness, we evaluated on 40 real-world CVEs and 240 objects in the stable Linux kernel tree. Our results show that discovers 1.6x more primitives and identifies 4.1x more sensitive objects compared to state-of-the-art approaches.

Keywords

Cite this article

@article{cai-7569,
  author  = {Xingwei Li and Yunchao Wang and Jianzhou Zhao and Yunchao Guan and Danjun Liu and Zhe Yang and Wenbin Zhang and Zehui Wu and Rongkuan Ma and Xixing Li and Qiang Wei},
  title   = {SyzPrime: Enhancing Linux Kernel Security for Edge Intelligence Applications via Automatic Discovery of Heap Layout Manipulation Primitives},
  journal = {Computing and Informatics},
  volume  = {45},
  number  = {3},
  pages   = {698--725},
  year    = {2026},
  issn    = {1335-9150},
  doi     = {10.31577/cai_2026_3_698}
}
Download .bib