When AI Makes 0-Days Feel Like N-Days

A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.

GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebula Security that exists in every major distribution since 2011. After turning it into a stable privilege escalation and container escape, we took one step further and used GhostLock to develop the world's first public Android 17 root. This writeup covers the additional exploit techniques used to migrate the exploit for Android.

Nicholas Carlini's epoll use-after-free in fs/eventpoll.c let RCU walkers race kfree() for a constrained write into a freed eventpoll; his Pixel 10 exploitation attempts fell short.

Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.

Exploiting CVE-2023-36802, a type confusion in Microsoft's mskssrv.sys driver, without the usual shortcuts: no NtQuery* leaks or PreviousMode read/write, only what works under current mitigations.

The authors reverse-engineered Chrome's January 2026 fix for CVE-2026-0899, an out-of-bounds access in V8, built a trigger PoC, and defeated a stubborn CHECK to reach arbitrary read/write.