cd ~/tags/kernel

kernel

2026-04-05

Breaking Isolation Boundaries: VM Escapes, Container Breakouts, and Sandbox Escapes

A deep technical analysis of 2025's most dangerous attack pattern — isolation boundary escapes. From vsock VM escapes to UNIX socket sandbox bypasses, understanding how attackers break out of…

14 min read

containers linux kernel security Virtualization Sandbox VM Escape Exploitation

2026-02-23

Seccomp-BPF: Confining Linux Processes at the Syscall Boundary

A deep dive into Linux seccomp-BPF — building syscall sandboxes from raw BPF filters to production-grade policies, with practical C examples and analysis of how Chrome, Docker, and systemd use…

23 min read

containers linux kernel security Seccomp BPF Sandboxing Syscalls Hardening

2026-02-21

eBPF for Security Monitoring: Kernel-Level Visibility Without the Overhead

A deep dive into using eBPF to build high-performance, kernel-level security monitoring tools — covering syscall tracing, network inspection, and intrusion detection with practical Python examples.

12 min read

linux kernel security eBPF Observability BCC Intrusion Detection Syscall Tracing

2025-03-16

How mmap Really Works: Page Tables, Page Faults, and the Virtual Memory Machinery

A deep dive into how Linux virtual memory actually works — from multi-level page tables and TLB mechanics to demand paging, copy-on-write, and the mmap implementation path through the kernel, with…

18 min read

linux kernel Virtual Memory mmap Page Tables Operating Systems Systems Programming Performance

2019-09-16

Understanding Dirty COW - The Linux Kernel Exploit

Dirty COW is a computer security vulnerability that was discovered in the Linux Kernel in 2016. The exploit was registered under CVE with the designation: CVE-2016-5195. Dirty COW is a root privilege…

6 min read

linux CVE exploit kernel