FreeBSoD Leveraging Language Models to Find and Exploit Kern...

[carlospolop]

Blog URL

https://praetorian.com/blog/ai-vulnerability-research-freebsd-kernel

Blog Title

FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 1 of 2)

Blog high summary

Praetorian used Claude Opus 4.6, CodeQL, Semgrep, and a KASAN-instrumented FreeBSD VM to hunt kernel bugs. CVE-2026-3038 is an unprivileged RTM_GET routing-socket stack overflow: an oversized RTAX_AUTHOR sockaddr reaches bcopy() and overwrites a 128-byte stack object by up to 127 bytes.

GENERIC kernels panic through __stack_chk_fail; reliable privilege escalation requires a separate stack-canary leak. The post also explains AI false positives, invalid SUID-based exploit claims, and filesystem-parser jailbreak chains. Fixed February 24, 2026.

PR changes

• src/AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.md: Added or revised coverage of Pattern-Guided Kernel Auditing with an Instrumented Oracle; Pattern database → CodeQL/Semgrep → focused review; Use KASAN telemetry as a hypothesis oracle; Reject exploit-precondition cheating.

Errors

mdbook build unavailable

[carlospolop]

merge

[carlospolop]

Conflict repair: resolved
Head: e08597643f244ad295c8819f73b4faf9530658d0

Adds pattern-guided kernel auditing, instrumented validation, and safeguards against unsupported exploitability claims.

• Resolved the complete conflict inventory while preserving both branches’ documentation.
• Preserved all substantive text, headings, external references, and complete fenced examples from both versions.
• Reconciled citation numbering and repaired the Stack Canaries link to its rendered index destination.
• Verified no unmerged paths or conflict markers remain; static preservation and navigation checks passed.