Linux Security Summit Europe 2026

There is no practical tool that maps userspace programs to the kernel code they exercise. strace shows syscall names but not kernel internals. KCOV requires kernel recompilation. perf is general-purpose and not designed for per-program kernel coverage.

vock fills this gap. It takes any userspace program and outputs the exact kernel functions and branches that program reaches.

Two modes:

(1) HW mode uses Intel PT or AMD LBR via perf_event_open() — works on any generic kernel without kcov. The PT decoder walks TNT bits against vmlinux to reconstruct full branch-level coverage.

(2) KCOV mode uses kernel instrumentation with per-process tracking across fork() and pthread_create().

Use cases: measure kernel vulnerability exposure per application, identify which kernel subsystems need hardening for a given workload, and narrow down the syscall space for targeted fuzzing — instead of fuzzing all 300+ syscalls, fuzz only the paths the target program actually reaches.

Vock is an acronym (and exact anagram) of Kcov.