BEGIN:VCALENDAR
VERSION:2.0
X-WR-CALNAME:lsseu2026
X-WR-CALDESC:Event Calendar
METHOD:PUBLISH
CALSCALE:GREGORIAN
PRODID:-//Sched.com Linux Security Summit Europe 2026//EN
X-WR-TIMEZONE:UTC
BEGIN:VEVENT
DTSTAMP:20260727T050441Z
DTSTART:20261008T060000Z
DTEND:20261008T154000Z
SUMMARY:Registration & Badge Pick-up
DESCRIPTION:\n
CATEGORIES:REGISTRATION
LOCATION:Congress Hall Foyer\, Prague\, Czechia
SEQUENCE:0
UID:b383cb5368bcf9fc1f355f97b1a7d48b
URL:http://lsseu2026.sched.com/event/b383cb5368bcf9fc1f355f97b1a7d48b
END:VEVENT
BEGIN:VEVENT
DTSTAMP:20260727T050441Z
DTSTART:20261008T070000Z
DTEND:20261008T070500Z
SUMMARY:Welcome & Opening Remarks - Elena Reshetova\, Intel
DESCRIPTION:\n
CATEGORIES:OPENING REMARKS
LOCATION:Chamber Hall\, Prague\, Czechia
SEQUENCE:0
UID:d820d6cd9cdd3bb8fbb08a3a43f63f52
URL:http://lsseu2026.sched.com/event/d820d6cd9cdd3bb8fbb08a3a43f63f52
END:VEVENT
BEGIN:VEVENT
DTSTAMP:20260727T050441Z
DTSTART:20261008T070500Z
DTEND:20261008T075000Z
SUMMARY:Security Implications of Kernel Electric Fence - Ernesto Martínez García\, Graz University of Technology
DESCRIPTION:With the continued rise of kernel heap vulnerabilities\, the Linux kernel community has done substantial effort in hardening the slab allocator through defense-in-depth mechanisms. \n \n Modern hardened kernels now rely on a combination of allocator-level protections\, including type and size segregation\, randomization\, memory tagging\, and others. \n These mechanisms significantly raise the bar for exploiting kernel heap bugs\, such as transforming a driver use-after-free vulnerability into a privilege escalation primitive. \n \n However\, the kernel memory-management subsystem is complex\, and heap allocations do not necessarily follow a single uniform path. \n \n In this presentation\, we examine Kernel Electric Fence (KFENCE)\, a low-overhead\, sample-based allocator designed to detect memory-safety errors in production systems. Enabled by default in RHEL\, Fedora\, Android\, and other distributions. \n \n We present how an attacker can target KFENCE-served allocations and use this alternative allocation path to weaken strong kernel heap hardening guarantees\, such as type and size segregation or memory tagging. \n \n Finally\, we show the current status of the solution on upstream Linux.
CATEGORIES:REFEREED PRESENTATIONS
LOCATION:Chamber Hall\, Prague\, Czechia
SEQUENCE:0
UID:6c93d3f01e7bc91178f7252f3aed7b14
URL:http://lsseu2026.sched.com/event/6c93d3f01e7bc91178f7252f3aed7b14
END:VEVENT
BEGIN:VEVENT
DTSTAMP:20260727T050441Z
DTSTART:20261008T075500Z
DTEND:20261008T084000Z
SUMMARY:Update on Landlock: Scoping\, Thread Synchronization\, Networking and More - Mickaël Salaün\, Cloudflare & Günther Noack\, Google Switzerland
DESCRIPTION:Landlock gained a few interesting features to restrict more operations. We'll explain unix socket restrictions\, signal scoping\, thread synchronization support\, and UDP control. We'll also walk through some lesser known Linux features that make such restrictions sometimes challenging to properly handle. Finally\, we'll talk about ongoing developments and the roadmap.
CATEGORIES:REFEREED PRESENTATIONS
LOCATION:Chamber Hall\, Prague\, Czechia
SEQUENCE:0
UID:64e3b61432f1faa5a06ccaf11e7a1d24
URL:http://lsseu2026.sched.com/event/64e3b61432f1faa5a06ccaf11e7a1d24
END:VEVENT
BEGIN:VEVENT
DTSTAMP:20260727T050441Z
DTSTART:20261008T084000Z
DTEND:20261008T090000Z
SUMMARY:Morning Break
DESCRIPTION:\n
CATEGORIES:BREAKS
LOCATION:Chamber Hall\, Prague\, Czechia
SEQUENCE:0
UID:c12f676378eb787e1a9ff39e7b79eaae
URL:http://lsseu2026.sched.com/event/c12f676378eb787e1a9ff39e7b79eaae
END:VEVENT
BEGIN:VEVENT
DTSTAMP:20260727T050441Z
DTSTART:20261008T090000Z
DTEND:20261008T094500Z
SUMMARY:Extending TPM Trust From the Kernel To Userspace - James Bottomley\, Microsoft
DESCRIPTION:The kernel uses a novel null seed scheme to protect the security of TPM communications against interposers as well as detect TPM reset attacks. Since the kernel can't verify the null seed on its own\, the name of the derived key is projected up to userspace to be verified there. However\, this verification can be done once on boot and lasts until the next reboot meaning any userspace application can simply inherit the check instead of going to all the bother of trying to verify trust in the TPM itself (which no current user space applications actually do because of the complexity involved). This talk will briefly describe how interposers work\, how TPM verification works\, what the null seed scheme is how trust can be established at OS install by using the TPM certificate to certify a signing EK and permanently store its name in the filesystem. This signing EK can be used on each boot to simply verify the null seed. Finally we'll give examples of user space tools using the null seed in real life to inherit the existing TPM trust.
CATEGORIES:REFEREED PRESENTATIONS
LOCATION:Chamber Hall\, Prague\, Czechia
SEQUENCE:0
UID:3f7118e16f8e3297acb2802f3a1ceb03
URL:http://lsseu2026.sched.com/event/3f7118e16f8e3297acb2802f3a1ceb03
END:VEVENT
BEGIN:VEVENT
DTSTAMP:20260727T050441Z
DTSTART:20261008T095000Z
DTEND:20261008T103500Z
SUMMARY:Libturnstile: Unprivileged Interactive Sandboxing From Seccomp-unotify To Landlock Supervise - Tingmao Wang\, Microsoft
DESCRIPTION:Existing unprivileged sandboxing solutions often rely on fixed rulesets without the ability to discover and dynamically approve additional accesses. Today\, there is no kernel API that supports this and is designed specifically for use by sandboxing tools or other integrated use cases like package managers or code editors. Over the past year\, I have pursued a solution to this from two angles: a userspace library called libturnstile using bind mounts and seccomp-unotify that works today\, and a series of proposed extensions to the Landlock LSM\, the first of which is currently merged in v7.2\, to support a sandboxer process being able to find out about denied accesses in a Landlock domain\, and apply policy changes before continuing the request. In this talk\, I will motivate this work by addressing the limitations of existing approaches. I will demo an example sandbox with shell integration implementing a simple config format and user-prompting UI\, discuss the implementation and what makes this non-trivial\, address limitations\, performance and testing\, and discuss the Landlock supervise proposal\, providing an update on progress and challenges\, and a summary of uAPI discussions.
CATEGORIES:REFEREED PRESENTATIONS
LOCATION:Chamber Hall\, Prague\, Czechia
SEQUENCE:0
UID:0c85efbe52cb40cc5fe1cef0fa0160d0
URL:http://lsseu2026.sched.com/event/0c85efbe52cb40cc5fe1cef0fa0160d0
END:VEVENT
BEGIN:VEVENT
DTSTAMP:20260727T050441Z
DTSTART:20261008T103500Z
DTEND:20261008T113500Z
SUMMARY:Lunch Break
DESCRIPTION:\n
CATEGORIES:BREAKS
LOCATION:Chamber Hall\, Prague\, Czechia
SEQUENCE:0
UID:4d6543a4f059314c80038dc7c75be935
URL:http://lsseu2026.sched.com/event/4d6543a4f059314c80038dc7c75be935
END:VEVENT
BEGIN:VEVENT
DTSTAMP:20260727T050441Z
DTSTART:20261008T113500Z
DTEND:20261008T122000Z
SUMMARY:Analyzing & Comparing MAC Policy - John Johansen & Georgia Garcia\, Canonical
DESCRIPTION:Different LSMs have different approaches to how they implement MAC policy. This session aims to present an analysis and comparison of Apparmor and SELinux approaches by transforming their policy into a common regular language. Using finite state analysis and transitive closure to find commonalities and differences between the different types of policy. We will discuss the approach used for the analysis\, its limitations and compromises made to be able to reach a common base. Looking at the difference in policy structure\, the number of rules\, types\, where\, and how they overlap and differ. Examining the different types of policies\, in both a static and dynamic capacity.
CATEGORIES:REFEREED PRESENTATIONS
LOCATION:Chamber Hall\, Prague\, Czechia
SEQUENCE:0
UID:50a1e4fa80c917e2e878d74919366a45
URL:http://lsseu2026.sched.com/event/50a1e4fa80c917e2e878d74919366a45
END:VEVENT
BEGIN:VEVENT
DTSTAMP:20260727T050441Z
DTSTART:20261008T122500Z
DTEND:20261008T125500Z
SUMMARY:Who Watches the Watcher? Hardening eBPF in Production Security Deployments - Hanshal Mehta\, Independent
DESCRIPTION:eBPF has become the backbone of modern Linux security tooling. Cilium\, Tetragon\, Falco\, etc they all depend on eBPF's ability to hook kernel execution paths and enforce policy without a kernel patch or reboot. But there's a question the community has been slow to ask: who secures eBPF itself? \n Working on bpfman\, an eBPF program manager\, exposed me to the trust assumptions baked into how programs get loaded\, pinned\, and granted kernel access. This talk covers what I found concrete attack surfaces that show up in real deployments\, not theory. \n \n We'll cover: the verifier's historical CVEs and what they reveal about its actual threat model\, privilege escalation through CAP_BPF and unprivileged eBPF in distros that ship with it enabled\, what program signing protects and what it quietly doesn't\, and LSM hooks on BPF program loading that most teams aren't using yet. \n The second half: BPF token scoping\, how Ubuntu and Fedora are locking down the attack surface without breaking legitimate tooling\,and a threat model checklist you can apply to your own eBPF deployment the same week. \n If you're running eBPF-based security tooling in production\, this is the talk I wished existed before I started.
CATEGORIES:SHORT TOPICS
LOCATION:Chamber Hall\, Prague\, Czechia
SEQUENCE:0
UID:d4783e284e4b83b1d4ff540810d5b943
URL:http://lsseu2026.sched.com/event/d4783e284e4b83b1d4ff540810d5b943
END:VEVENT
BEGIN:VEVENT
DTSTAMP:20260727T050441Z
DTSTART:20261008T130000Z
DTEND:20261008T134500Z
SUMMARY:Making AppArmor Confinement Actually Reach Production: An End-to-end Lifecycle for 1\,700 Profiles - Maxime Bélair\, Canonical
DESCRIPTION:Upstream AppArmor ships around 120 confining profiles\, mostly for system and network services\, so most applications run unconfined. apparmor.d\, the main effort at comprehensive confinement\, ships around 1\,700 profiles but barely reaches production. No distribution enables it\, for good reasons: enforcing them all is heavy on CPU and memory\; many profiles are unused or too strict for interactive use\, breaking applications\; complain mode gives no real protection but floods the logs. Finally\, when a software update breaks a profile\, nothing notices. We present an end-to-end pipeline that turns a profile set like apparmor.d into shipped\, maintained policy with working\, open-source tooling at each stage. Distro-agnostic automated testing (autopkgtest\, upstream\, spread\, custom) and refinement cut authoring and upkeep to a small\, evidence-backed review. aa-sync\, an upstream RFC\, ships every profile read-only and enforces only the vetted subset matched to the user's needs and installed applications. It grows coverage as profiles mature\, and re-syncs after each package transaction so confinement survives updates\, a step towards to fully confined systems.
CATEGORIES:REFEREED PRESENTATIONS
LOCATION:Chamber Hall\, Prague\, Czechia
SEQUENCE:0
UID:9415455f751676c95b423a3cda7857cf
URL:http://lsseu2026.sched.com/event/9415455f751676c95b423a3cda7857cf
END:VEVENT
BEGIN:VEVENT
DTSTAMP:20260727T050441Z
DTSTART:20261008T134500Z
DTEND:20261008T140500Z
SUMMARY:Afternoon Break
DESCRIPTION:\n
CATEGORIES:BREAKS
LOCATION:Chamber Hall\, Prague\, Czechia
SEQUENCE:0
UID:b6141959ef18e79dd0a10a911723c382
URL:http://lsseu2026.sched.com/event/b6141959ef18e79dd0a10a911723c382
END:VEVENT
BEGIN:VEVENT
DTSTAMP:20260727T050441Z
DTSTART:20261008T140500Z
DTEND:20261008T145000Z
SUMMARY:Vock: Mapping Kernel Attack Surface With Zero-Configuration Coverage - Yunseong Kim\, Ericsson Software Technology
DESCRIPTION:There is no practical tool that maps userspace programs to the kernel code they exercise. strace shows syscall names but not kernel internals. KCOV requires kernel recompilation. perf is general-purpose and not designed for per-program kernel coverage. vock fills this gap. It takes any userspace program and outputs the exact kernel functions and branches that program reaches. Two modes: (1) HW mode uses Intel PT or AMD LBR via perf_event_open() — works on any generic kernel without kcov. The PT decoder walks TNT bits against vmlinux to reconstruct full branch-level coverage. (2) KCOV mode uses kernel instrumentation with per-process tracking across fork() and pthread_create(). Use cases: measure kernel vulnerability exposure per application\, identify which kernel subsystems need hardening for a given workload\, and narrow down the syscall space for targeted fuzzing — instead of fuzzing all 300+ syscalls\, fuzz only the paths the target program actually reaches. Vock is an acronym (and exact anagram) of Kcov.
CATEGORIES:REFEREED PRESENTATIONS
LOCATION:Chamber Hall\, Prague\, Czechia
SEQUENCE:0
UID:a8dcc812c2d3e867d91a2085aae16282
URL:http://lsseu2026.sched.com/event/a8dcc812c2d3e867d91a2085aae16282
END:VEVENT
BEGIN:VEVENT
DTSTAMP:20260727T050441Z
DTSTART:20261008T145500Z
DTEND:20261008T154000Z
SUMMARY:Personalization of Generic Confidential VMs With Retrievable Secrets - Reinhard Buendgen\, IBM & Finn Callies\, Unknown Company
DESCRIPTION:Confidential Computing secures an important attack vector for sensitive workloads: a provider cannot inspect or manipulate a confidential computing workload via its main memory or CPU registers. One of the key challenges of Confidential Computing is to turn a confidential virtual machine (cVM) started from a generic boot image provided by an ISV or Linux distributor into a tenant specific cVM. That is a cVM that contains tenant secrets that on the one hand side restrict unauthorized access to the cVM and on the other hand allows the cVM to identify itself towards the tenant. This presentation shows how this goal can be achieved with retrievable secrets a new technology of IBM Secure Execution for Linux (SEL) that allows to insert secrets as hardware backed keys into to a running SEL guest. These hardware backed keys are opaque to the operating system and can be used to protect LUKS volumes and as TLS signing keys. The SEL early boot customization (ECB) framework defines a QCOW2 image format including tooling and systemd units to easily generate personalized boot volumes for cVMs.
CATEGORIES:REFEREED PRESENTATIONS
LOCATION:Chamber Hall\, Prague\, Czechia
SEQUENCE:0
UID:afaa89d9c61fb937bad29f775dc94ea5
URL:http://lsseu2026.sched.com/event/afaa89d9c61fb937bad29f775dc94ea5
END:VEVENT
END:VCALENDAR