Reference for the acronyms relevant to kernel vulnerability research. Each entry expands the term first, then defines it, then states why it matters here.
RCU — Read-Copy-Update. A lockless read scheme. Readers enter rcu_read_lock() with no atomics. Writers replace a pointer and defer freeing the old object until every pre-existing reader has finished. That deferred free is the whole source of the P1 bug class.
Grace period. The wait until all readers that could see an old object have released it. call_rcu and kfree_rcu free after one grace period.
call_rcu / kfree_rcu. Queue an object to be freed after the next grace period, instead of freeing it now.
rcu_dereference. The correct way to load an RCU-protected pointer inside a reader.
BH — Bottom Half. The deferred half of interrupt handling. The interrupt top half stays minimal and the real work runs later.
softirq — software interrupt. The high-priority deferred context that runs bottom-half work. Network receive, timers, tasklets, and block completion run here, asynchronously to any syscall.
tasklet. A simple deferred callback that runs in softirq context.
NAPI — New API. The network driver polling framework. It processes received packets in softirq context.
IRQ — Interrupt ReQuest. A hardware interrupt. The handler can preempt almost anything, so state it touches needs spin_lock_irqsave.
NMI — Non-Maskable Interrupt. An interrupt that cannot be blocked by disabling normal interrupts.
PMI — Performance Monitoring Interrupt. The NMI-class interrupt the CPU raises on a perf counter overflow. It was the async context in the perf overflow race, CVE-2026-23271.
PMU — Performance Monitoring Unit. The CPU hardware that counts events and raises the PMI.
Workqueue. A mechanism to defer work to a kernel thread. queue_work schedules a function to run later in a kworker.
kworker. The kernel thread that runs queued workqueue items.
delayed_work. A workqueue item scheduled to run after a delay.
task_work. A queue of callbacks that run when a specific task returns to userspace. File teardown through fput rides this, so closing a file frees it later, not inline.
timer_list. The classic kernel timer, with jiffy granularity. Its callback runs in softirq.
hrtimer — high-resolution timer. A nanosecond-granularity timer whose callback runs in softirq or hardirq.
jiffies. The kernel tick counter. The unit for timer_list timeouts.
Preemption. The scheduler taking a CPU away from running kernel code.
PREEMPT_NONE. A build with no involuntary kernel preemption. The paid kernelCTF target uses it, which closes races that only open on preemptible kernels.
PREEMPT_RT. The fully preemptible real-time build. Some syzbot races reproduce only here and are therefore out of scope for the target.
per-CPU. Data with a separate copy per CPU, to avoid locking.
spinlock. A busy-wait lock for short critical sections that cannot sleep.
mutex. A sleeping lock for longer sections.
rt_mutex — real-time mutex. A priority-inheriting sleeping lock. It backs futex priority inheritance and was the subject of CVE-2026-43499.
seqlock — sequence lock. A lock optimized for rare writers and frequent readers, using a sequence counter.
siglock. The spinlock inside sighand_struct that serializes signal and posix-timer state for a process.
READ_ONCE / WRITE_ONCE. Force a single, non-torn compiler access to a shared variable.
smp_rmb / smp_wmb / smp_mb. Read, write, and full memory barriers on multi-processor systems.
smp_store_release / smp_load_acquire. Paired barriers that publish and observe a value with ordering. The CVE-2026-64560 fix added a store-release on sighand = NULL. On x86 these are compiler barriers only.
SLAB / SLUB / SLOB. The kernel heap allocators. SLUB is the current default. Objects of one type live in a dedicated cache.
kmalloc. General kernel allocation. Requests fall into size-class caches named kmalloc-8, kmalloc-16, and so on.
kmem_cache. A dedicated slab cache for one object type, for example posix_timers_cache.
SLAB_TYPESAFE_BY_RCU. A cache flag that lets a freed slot be reused within the RCU grace period. The pointer stays valid-typed but may point at a different object, so identity must be rechecked. It complicated CVE-2026-46242.
INIT_ON_ALLOC / INIT_ON_FREE. Config options that zero slab memory on allocation or free. Both are OFF on the target, so uninitialized reuse and residual pointers work.
Cross-cache attack. Freeing an object so its page returns to the allocator, then reclaiming that page as a different cache to overlap two object types. Viable on the target because it uses normal SLUB.
Page allocator / buddy. The lower allocator that hands out physical page runs. order-0 is a single page.
GFP flags. Allocation-context flags passed to kmalloc, for example GFP_KERNEL.
PTE — Page Table Entry. One entry mapping a virtual page to a physical page. The essiv exploit, CVE-2025-40019, wrote a forged PTE.
PGD — Page Global Directory. The top level of the page tables.
physmap / direct map. The kernel's linear mapping of all physical memory. A target for KASLR-independent attacks.
refcount_t / atomic_t. Reference and atomic counters. Teardown runs when the last reference drops.
kref. A reference-count helper. kref_put runs the release function on the final put.
fget / fput. Take and drop a reference to a struct file. The final fput defers destruction through task_work.
__fput / ____fput. The deferred file destruction functions that run later, not at the fput call site.
get_task_struct / put_task_struct. Take and drop a reference to a task.
sock_hold / sock_put. Take and drop a reference to a socket.
task_struct. The kernel structure for a thread.
Thread group. The set of threads that share a process. They share a TGID.
TGID — Thread Group ID. The identifier userspace calls the process ID.
PID — Process ID. Per thread inside the kernel. PIDTYPE_TGID and PIDTYPE_PID select which identity a lookup targets.
exec / execve. Replace the current program image. A non-leader thread doing this triggers the sensitive path.
de_thread. The exec-time routine that tears down the other threads and makes the caller the sole thread and leader. It is the hot lifecycle transition in the newest bug cluster.
switch_leader. The step inside de_thread that transfers thread-group leadership to a new task.
release_task / __exit_signal. The reaping path for a dying task. __exit_signal sets sighand = NULL, which is the signal that misleads the racing delete paths.
sighand — signal handler struct. The shared signal state for a process. A NULL sighand means the task is being reaped, and misreading that NULL is the core of the P2 bugs.
signal_struct. The per-process signal and timer state, including the process-wide cpu timer queues.
Zombie. A task that has exited but not yet been reaped.
exit_state. The field that marks a task as exiting or dead. The CVE-2025-38352 fix checks it.
cred — credentials. The uid, gid, and capability set of a task. Overwriting a cred is a common route to root.
CAP_* — capabilities. Fine-grained privilege bits, for example CAP_NET_ADMIN and CAP_SYS_ADMIN. The target gates many surfaces behind these.
userns — user namespace. A namespace that can grant capabilities inside it. It is disabled on the target, which closes many surfaces.
k_itimer. The kernel object for a posix timer. It is the freed object in CVE-2026-64560.
cpu_timer / timerqueue. The embedded node and the red-black tree that hold armed cpu timers. A dangling timerqueue node is the UAF primitive in the posix-timer bugs.
AF_* — Address Family. The socket domain. Key ones on the target are AF_UNIX, AF_INET, AF_NETLINK, and AF_ALG.
AF_UNIX. Local sockets. They pass file descriptors and run a garbage collector, which produced several bugs.
AF_NETLINK. The kernel configuration and event socket family.
AF_ALG. The userspace interface to the kernel crypto API. A rich surface because userspace can force many crypto templates to instantiate.
AF_PACKET / AF_XDP. Raw packet families. Both need CAP_NET_RAW, so they are not unprivileged on the target.
ULP — Upper Layer Protocol. A protocol layered on TCP. setsockopt(TCP_ULP, "tls") installs kernel TLS.
kTLS — kernel TLS. TLS record processing inside the kernel. The top confirmed surface, with several bugs.
SCM_RIGHTS. The ancillary message type that passes file descriptors between processes. It drives the AF_UNIX garbage collector.
cmsg — control message. Ancillary data attached to a sendmsg or recvmsg.
skb / sk_buff — socket buffer. The kernel packet structure. A freed skb behind a stale pointer is the UAF in the TLS parser bugs.
skb_shared_info. The metadata at the end of an skb data buffer, including the page fragment array. A common overflow target.
frags. The paged fragment array in an skb.
GC — Garbage Collection. Here it means the AF_UNIX collector for cycles of in-flight file descriptors.
in-flight fd. A file descriptor sitting in a socket's receive queue, not yet received.
SCC — Strongly Connected Component. A cluster in a directed graph. The AF_UNIX collector uses Tarjan SCC detection, which CVE-2025-40214 corrupted.
unix_vertex / unix_edge. The graph nodes and edges the AF_UNIX collector builds over in-flight sockets.
sock_diag / NETLINK_SOCK_DIAG. The socket introspection interface. Its dump path walks socket hashtables and reached the rhashtable bug CVE-2026-64563.
rhashtable — resizable hashtable. The kernel's growable hashtable library. Its walk resume path held a stale cursor in CVE-2026-64563.
rhashtable_walk. An iterator over an rhashtable that can stop and resume. The resume seam was the bug.
MSG_PEEK / MSG_MORE / MSG_SPLICE_PAGES. Send and receive flags. Peek reads without consuming, More holds data for coalescing, and Splice moves pages by reference.
splice / zero-copy. Moving data between file descriptors by page reference instead of copying. It reached freed pages in the TLS bugs.
reuseport. A group of sockets sharing a port, selected by a filter. The classic BPF variant produced CVE-2026-52910.
conntrack — connection tracking. Netfilter state tracking. Its processing on traffic is reachable, but its configuration needs CAP_NET_ADMIN.
netfilter / xtables / nftables. The packet filtering frameworks. nftables is compiled out on the target, which removed the historically top surface.
XFRM. The IPsec transformation framework. It reaches crypto templates and is under-explored.
ESP — Encapsulating Security Payload. The IPsec packet format that pulls in the authencesn crypto template.
PF_KEY. The key management socket for IPsec.
AEAD — Authenticated Encryption with Associated Data. Encryption that also authenticates plaintext and extra header data.
authenc / authencesn. Templates that combine a cipher and a hash. The esn variant assumes ESP framing and rejected too-short input only after the fix, CVE-2026-23060.
essiv. An IV-generation template. Its length check was missing on one branch in CVE-2025-40019.
gcm / cbc / cts / ccm / lrw / xts. Cipher modes and templates present on the target. They form the force-instantiation space.
assoclen — associated data length. The length of the authenticated header region. Attacker control of it drove the P4 underflow bugs.
ivsize — initialization vector size. Subtracted from assoclen in the underflowing arithmetic.
scatterlist / scatterwalk / SGL. A list of memory segments and the walker over it. Crypto operates on scatterlists, and a bad offset walks out of bounds.
cryptd. The kernel thread that runs deferred crypto. It produces the async -EBUSY completion path.
-EINPROGRESS / -EBUSY. Return codes meaning the crypto request will finish later through a callback. Double-cleanup on -EBUSY was CVE-2026-31533.
Crypto template. A named construction such as essiv(authenc(hmac(sha256),cbc(aes)),sha256) that userspace can force the kernel to build.
Force instantiation. Binding an AF_ALG socket to a template name to make the kernel construct that code path on demand.
KASLR — Kernel Address Space Layout Randomization. Randomizes the kernel base. Rules require defeating it without a separate leak.
KASAN — Kernel Address SANitizer. Debug instrumentation that reports a use-after-free loudly. It is what a trigger PoC lands on.
KCSAN / KMSAN. Sanitizers for data races and uninitialized memory.
SMEP / SMAP. CPU features that block the kernel from executing or accessing user pages.
KPTI — Kernel Page Table Isolation. Separates kernel and user page tables to mitigate Meltdown.
CFI / kCFI / CFI_CLANG. Control-Flow Integrity. It checks indirect call targets. It is OFF on the target, so function-pointer hijacking is not blocked.
IBT — Indirect Branch Tracking. A coarse hardware forward-edge check. It is present on the target.
STACKPROTECTOR. Stack canaries against linear stack overflows.
FORTIFY_SOURCE. Compile-time and run-time bounds checks on common memory functions.
HARDENED_USERCOPY. Bounds checks on copies between kernel and user.
SLAB_FREELIST_RANDOM / SLAB_FREELIST_HARDENED. Randomize and obfuscate the slab freelist, and detect some double frees. Both are present on the target.
STATIC_USERMODEHELPER. Routes usermode helpers through a fixed path. It is OFF on the target, so overwriting core_pattern or modprobe_path gives root.
SLAB_VIRTUAL. A mitigation-only feature that isolates slab virtual addresses. It is absent on the target, so cross-cache attacks work.
LSM — Linux Security Module. The security hook framework. The target stack includes lockdown, yama, loadpin, safesetid, integrity, apparmor, and bpf.
SELinux / AppArmor / Landlock / Yama / lockdown. Individual security modules. The exploit runs unconfined, and SELinux and Landlock are off.
seccomp — secure computing. A syscall filter. The target places no seccomp filter on the exploit, so the full syscall table is available.
bpf_jit_harden. Constant blinding for the BPF JIT.
dmesg_restrict / kptr_restrict. Restrict kernel log and pointer visibility. dmesg is restricted on the target, so there is no log oracle.
UAF — Use-After-Free. Access to memory after it is freed. The dominant class in this corpus.
OOB — Out-Of-Bounds. A read or write past an allocation.
TOCTOU — Time-Of-Check to Time-Of-Use. A race between validating a value and using it.
Double-free. Freeing the same object twice, often through duplicated cleanup.
Type confusion. Treating memory as the wrong type.
Uninit — uninitialized use. Reading a field never set on allocation. It works here because zero-on-alloc is off.
Heap spray / grooming. Allocating many objects to control heap layout before a bug fires.
Reclaim. Allocating controlled data into a freed slot or page after a free.
AAR / AAW — Arbitrary Address Read / Write. The strong primitives an exploit aims to build.
Primitive. A reusable capability such as a controlled write, a leak, or a free.
core_pattern / modprobe_path. Kernel settings that name a userspace helper. Overwriting either gives root when usermode helpers are not static.
usermodehelper. The mechanism that runs a userspace program from the kernel, for example a coredump handler.
ROP / JOP — Return / Jump Oriented Programming. Reusing existing code by chaining gadgets.
Info leak. A disclosure of kernel data such as a pointer. It has no value on its own without a corruption bug that needs it.
LTS — Long Term Support. The supported stable kernel series. The paid target is the latest hardened LTS.
COS — Container-Optimized OS. Google's kernel variant. It is an unpaid target now.
Mitigation instance. A previous hardened target with extra sysctls. It is deprecated as a paid target.
0-day. A bug with no mainline patch and no public disclosure of any kind.
1-day / n-day. A bug already patched upstream but not yet backported to the target series. The gap is the exploitable window.
dedup / dupe. The rule that only the first submission of a given bug is rewarded.
Slot / drop / bump. One paid capture per version bump. The version drops at a fixed time and the first valid capture wins.
Flag. The secret captured by a working exploit on the live instance.
exp<NNN>. A kernelCTF submission identifier, for example exp527.
Novelty track. A separate reward for a novel technique. It is exempt from dedup and can be submitted off the race clock.
syzkaller / syzbot. The kernel fuzzer and its public dashboard of crashes.
kernelXDK. An exploit development kit used by some submissions. It resolves target symbols and struct layouts.
kxdb / TargetDb. The kernelXDK database of per-target offsets and symbols.