Linux Security Summit Europe 2026

With the continued rise of kernel heap vulnerabilities, the Linux kernel community has done substantial effort in hardening the slab allocator through defense-in-depth mechanisms.

Modern hardened kernels now rely on a combination of allocator-level protections, including type and size segregation, randomization, memory tagging, and others.
These mechanisms significantly raise the bar for exploiting kernel heap bugs, such as transforming a driver use-after-free vulnerability into a privilege escalation primitive.

However, the kernel memory-management subsystem is complex, and heap allocations do not necessarily follow a single uniform path.

In this presentation, we examine Kernel Electric Fence (KFENCE), a low-overhead, sample-based allocator designed to detect memory-safety errors in production systems. Enabled by default in RHEL, Fedora, Android, and other distributions.

We present how an attacker can target KFENCE-served allocations and use this alternative allocation path to weaken strong kernel heap hardening guarantees, such as type and size segregation or memory tagging.

Finally, we show the current status of the solution on upstream Linux.