Search: “kernel driver”

12 stories in the last 3d

Two developers built a fully OpenGL ES 3.0 compliant Linux GPU driver for the M4 Mac Mini in one month via clean-room reverse engineering.

Niklas and the author reverse engineered Apple's AGX GPU firmware ABI and user-space components in about a month, a process that normally takes years, producing an OpenGL ES 3.0 conformant driver fast enough to run Minecraft at 200fps on an M4 Mac Mini. The work was done transparently using hypervisor traces without examining Apple binaries, following clean-room practices, and included a custom shader compiler, command stream builder, and a full Linux kernel driver for the firmware ABI. The A18 Pro firmware ABI proved significantly more complex than the M1's, with 1.5x as many structs and twice as many pointers. All experiments and provenance evidence were published in public agx-re repositories.

Hacker News · AISep 15, 19:30 UTC · 10h agoResearch HN 40↑ · 5 comments

DeepZero: Open-source hunting for vulnerable Windows driversnew

DeepZero, a new open-source engine, automates discovery of exploitable Windows kernel drivers for BYOVD attacks using Ghidra, Semgrep, and an LLM.

DeepZero is a free, open-source Python pipeline orchestrator that automates hunting for exploitable Windows kernel drivers relevant to BYOVD (bring your own vulnerable driver) attacks. Its seven-stage YAML pipeline parses PE headers, filters for kernel-mode drivers with IOCTL surfaces, excludes drivers listed on loldrivers.io, then runs headless Ghidra decompilation, Semgrep scanning, and an LLM-based exploitability assessment. The maintainer reports multiple verified vulnerabilities in the Snappy Driver Installer corpus, some still in the disclosure process, and notes findings involving plug-and-play-created device objects may need physical hardware to confirm.

Help Net Security05:30 UTC · 42m agoTools

ZDI-26-702: Linux Kernel usbnet Driver Race Condition Privilege Escalation Vulnerability

ZDI discloses Linux Kernel usbnet driver race condition (CVE-2025-22050) enabling physically present attackers to escalate privileges without authentication.

ZDI-26-702 covers a race condition privilege escalation vulnerability in the Linux Kernel usbnet driver, assigned CVE-2025-22050 with a CVSS rating of 7.1. A physically present attacker can escalate privileges on affected installations. Authentication is not required to exploit the vulnerability.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2025-22050

ZDI-26-692: Linux Kernel eMPIA USB Device Driver Race Condition Code Execution Vulnerability

ZDI-26-692: race condition in Linux kernel eMPIA USB driver (CVE-2026-31583) lets physically present attackers execute code without authentication; CVSS 7.1.

ZDI advisory ZDI-26-692 discloses a race condition in the Linux kernel's eMPIA USB device driver that allows physically present attackers to execute arbitrary code on affected installations. Authentication is not required, but physical access to the target system is necessary. ZDI assigned a CVSS rating of 7.1 and CVE-2026-31583.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-31583

ZDI-26-685: Linux Kernel NFC NCI UART Driver Race Condition Local Privilege Escalation Vulnerability

ZDI discloses a race condition in the Linux kernel NFC NCI UART driver (CVE-2025-38416, CVSS 8.8) allowing local low-privileged attackers to escalate privileges.

ZDI advisory ZDI-26-685 covers a race condition vulnerability in the Linux kernel's NFC NCI UART driver, tracked as CVE-2025-38416 with a CVSS score of 8.8. A local attacker with the ability to execute low-privileged code can exploit the race to escalate privileges on affected systems. Exposure is limited to systems where the NFC NCI UART driver is present, and no exploitation is reported.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2025-38416

FlashVector: Agent for Hierarchical Model Serving Stack Optimization

FlashVector agent optimizes all layers of Unity's ad-serving stack, delivering up to 2x model-server throughput and 1.98x latency speedup in production.

FlashVector is an agentic system that optimizes performance across GPU kernels, ML framework computation graphs, model servers, and on-demand feature processing. Deployed in Unity's Vector advertising platform, it achieved up to 2x model-server throughput increase, 1.98x latency speedup, and 1.6x feature-store throughput gain. Optimizations spanned NVIDIA Triton's C++ codebase and the Python feature transformation service, demonstrating extensibility beyond single-kernel tuning.

arXiv cs.AI / cs.LG / cs.CLSep 15, 16:27 UTC · 13h agoAI research

You Shall Not Pass into Ring-0! A User Privacy-Friendly Anti-Cheat Architecture for Personal Computers

Tirith replaces invasive kernel-level game anti-cheats with protected VMs and a dual-trusted virtualization monitor, preserving detection and near-native performance.

Researchers present Tirith, an anti-cheat architecture that runs video games in Protected Virtual Machines, sandboxing computations from untrusted root admins, and uses a virtualization monitor trusted by both players and developers to watch for malicious drivers. This removes the need for privacy-invasive ring-0 kernel anti-cheat components while matching their protection against a wide range of cheating mechanisms. To overcome VM stack limitations, the work contributes a security-focused Library OS kernel for games and an efficient graphics sharing pipeline for near-native rendering performance.

arXiv cs.CRSep 15, 17:56 UTC · 12h agoResearch

USN-8760-1: Linux kernel (NVIDIA) vulnerabilities

Canonical issues USN-8760-1 patching multiple Linux kernel (NVIDIA) vulnerabilities across numerous subsystems and CPU architectures.

Canonical published USN-8760-1 to correct several Linux kernel (NVIDIA) vulnerabilities that an attacker could possibly use to compromise the system. The update fixes flaws spanning UAPI, the kernel build system, ARM32, ARM64, RISC-V, S390, and x86 architectures. Patched subsystems also include the block layer, cryptographic API, Compute Acceleration Framework, Intel NPU driver, ACPI and Bluetooth drivers, and the hardware random number generator core.

Ubuntu Security NoticesSep 15, 09:15 UTC · 20h agoAdvisory

USN-8761-1: Linux kernel (Azure) vulnerabilities

Ubuntu patches multiple Linux kernel (Azure) flaws across ARM64, Bluetooth, Netfilter, NTFS3, SMB and other subsystems.

Ubuntu security notice USN-8761-1 corrects several security issues in the Linux kernel for Azure, spanning ARM32, ARM64, and PowerPC architectures plus subsystems including Bluetooth, Netfilter, EFI core, GPU drivers, InfiniBand, SCSI, NTFS3, and SMB. An attacker could possibly use these flaws to compromise the system.

Ubuntu Security NoticesSep 15, 09:42 UTC · 20h agoAdvisory 2 sources

Dream-RSI: Recursive Self-Improvement through Evolving Worlds

Dream-RSI refines exploration policies by dreaming in replay simulators built from discovery history, cutting discovery costs across coding tasks.

Dream-RSI is a framework for scalable recursive self-improvement in autonomous coding agents, where a lightweight orchestration layer makes exploration explicit and programmable while leaving the underlying agent unchanged. Its core insight is that accumulated discovery history can serve as a replay simulator over the realized search space, providing immediate, low-cost off-policy feedback to evaluate and refine exploration policies without expensive online evaluations. Across algorithm engineering, mathematical optimization, and GPU kernel engineering, Dream-RSI achieves competitive or improved discovery quality at substantially reduced cost.

Hugging Face daily papersSep 13, 20:00 UTC · 2d agoAI research

Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories

Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.

Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.

Cyber Security NewsSep 14, 03:10 UTC · 2d agoExploit / PoC in the wildCVE-2026-85880 CVE-2026-81963 CVE-2025-25249+3 CVEs2

The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

Elastic details KREMLIN, a Brazilian banking malware whose malicious Chrome/Edge extension forges Chromium integrity checks to steal sessions.

Elastic Security Labs tracked operation REF9334 and its KREMLIN toolkit, a Brazilian banking malware campaign impersonating twelve banks across seven campaigns since May 2025. The infection chain uses multi-stage obfuscated JavaScript loaders with sandbox checks (file and process counting), scheduled-task persistence, and an Ethereum smart contract acting as a dead-drop resolver for C2 and payload URLs, abusing Archive.org for hosting. The malicious browser extension bypasses Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs and App-Bound encrypted hashes. Threat Command disrupted over 1,500 infections by registering the kill-switch canary domain.

Elastic Security LabsSep 14, 00:00 UTC · 2d agoMalware in the wild