# Kernel Security Audit

> Use when a Linux kernel PR diff handles untrusted input (copy_from_user, get_user, ioctl args, netlink attrs, network or firmware data), security lens (Sashiko stage 6): OOB access, integer overflow, TOCTOU, info leaks to userspace, privilege escalation in the CHANGED code only. Part of the linux-kernel-review suite.

- Skill: `gvago/kernel-security-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gvago/kernel-security-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gvago/kernel-security-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: gvago (https://skillmd.com/u/gvago)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gvago/kernel-security-audit

---


# kernel-security-audit

Lens for security review of a kernel patch (Sashiko stage 6). Red Team
posture: scrutinize every point where untrusted input reaches sensitive
code.

## How to apply

- Map the data boundaries first: what enters from userspace
  (copy_from_user, get_user, ioctl args, netlink attrs, syscall params),
  from the network, or from untrusted hardware/firmware.
- Follow each untrusted value to every use. A missing or weak validation
  between entry and use is the finding.
- Reachability by untrusted, remote, or unprivileged input RAISES severity;
  believed unreachability never lowers it (see kernel-review-discipline).

## Rule index

- S1. Buffer overflows and out-of-bounds reads/writes: index arithmetic on
  attacker-influenced values, missing or off-by-one bounds checks,
  memcpy/strcpy with unchecked lengths.
- S2. Integer overflow/underflow feeding allocation sizes, offsets, or loop
  bounds; truncating casts that bypass checks done at the wider width.
- S3. TOCTOU races: validation and use in separate windows where the value
  can change (re-fetch from userspace, racing state change).
- S4. Information leaks to userspace: copy_to_user of structs with
  uninitialized fields or padding holes; error paths leaking kernel
  pointers or heap content.
- S5. Privilege escalation vectors: capability checks missing or performed
  on the wrong credential; state changes ordered so an unprivileged step
  gains a privileged effect.

## Mapping a finding to the contract

- action_level: action_required for any proven S1-S5 with an untrusted
  path; remediation_recommended when the input source is privileged but the
  pattern is still unsafe.
- category: Security.
- evidence: entry point of the untrusted value, the propagation chain, the
  unsafe use, functions and lines. State the attacker precondition.

## What NOT to flag

- Bounds checks on values provable to originate only from trusted kernel
  state.
- Constructs that look unsafe but sit behind capability checks you can
  cite, cite them and dismiss instead.
- Hardening suggestions (e.g. "use strscpy everywhere") without a proven
  vulnerable path.

## Sourcing

Stage text adapted from Sashiko (Apache-2.0).