Taking a page from the kernel's book: A TLB issue in mremap()

Part 3 of the MTE As Implemented series, examining kernel-side support for Arm Memory Tagging Extension, its performance costs, and gaps observed in real implementations.

An examination of how null pointer dereferences in the Linux kernel can be turned into exploitable primitives under modern configurations, with examples and mitigations.

A report on an arbitrary recursion bug in the Linux kernel, triggerable by a local user on Ubuntu systems installed with home directory encryption support, with exploit code published.

A guest post describing CVE-2017-7308, a signedness bug in Linux packet sockets leading to a heap out-of-bounds write and local privilege escalation, found via syzkaller.

Part 7 of the Windows Registry Adventure series, mapping which Windows components parse registry data and identifying the most promising attack surface for deeper research.

Part one of a macOS audio series: building a fuzzer for CoreAudio by sending Mach messages, covering the attack surface, harness design, and early results.