Kernel-Exploit-Dojo

mito753‘s archive of Linux kernel exploitation practice, and the cleanest case this spoke has of a curriculum that is its exam. The README’s own description: “a curated archive of 100+ Linux kernel exploitation CTF challenges, organized by bug class, exploitation primitive, final technique, difficulty, and solve count.” 403★ / 62 forks over 696 commits, challenges spanning 2020–2026, exploit code in C. No license stated. Read 2026-08-10.

What is in it

Challenges are filed by year, each in its own directory with a fixed template: a README, the distribution/ files the competition handed out, an exploit/, and a writeup/. Two index files sit over the archive — the main README lists challenges, TECHNIQUES.md navigates the same corpus by technique.

The technique index names bug classes and exploitation primitives (use-after-free, heap spraying, pipe_buffer and msg_msg abuse, modprobe_path and credential overwrites, stack overflow, kernel ROP, KASLR bypass) and a harder tier beyond them (eBPF/DWARF VM, Dirty Pipe, DirtyCred, page-cache attacks, io_uring, EPT and hypervisor work, LDT call gates, UEFI). Difficulty runs Very-Easy to Very-High.

The repository states its own scope: “This repository is for CTF learning and local lab environments only. Do not run the exploits on production systems or systems you do not own.” It is catalogued here as a teaching artifact — its structure, pedagogy and evidence — and this wiki records neither technique detail nor operational guidance.

The exam is the curriculum, with nothing in between

The spoke’s standing claim is that where an assessment regime exists, it shapes scope — pedagogy gets chosen on other grounds. Every prior case reached that conclusion indirectly: coding-interview-university drops frontend and SQL because the interview does, but somebody still sat down and wrote a study plan.

Here there is no intermediate step. The scope is not shaped by the exam, it is a transcript of the exam: 100+ past competition problems, kept with the files the organizers shipped. If the claim is right, this is what it looks like taken to the limit, and the limit turns out to be a problem-archive rather than a syllabus.

The CTF regime is also a genuinely different exam from the one behind the rest of the corpus. A hiring interview is private, unscored in public, and repeated across candidates. A CTF is public, scored, time-boxed, adversarial, and each problem is used once. That difference is what supplies the evidence below.

The first difficulty signal in the corpus

Every source here so far has offered popularity and nothing else, and the spoke’s standing caveat is that stars measure intent to learn rather than learning. This archive carries per-challenge difficulty and solve counts, and a solve count is not marketing — it is a record of how many competitors actually landed the problem under time pressure.

Two limits on that, stated plainly. It is a signal about the item, not about the learner: knowing that six teams solved a problem says nothing about whether working through it afterwards teaches anyone anything. And the counts are inherited from the competitions, not measured here, so their comparability across events is unestablished. Still, it is the first quantitative claim in this corpus that is about the material rather than about its audience, and the gap it half-fills is the spoke’s oldest.

Pedagogy: no sequence, two indexes

There is no order to work through. Like prompt-engineering-guide, this is a reference you enter from wherever you are, and it goes further by shipping two entrances over one corpus: chronological by challenge, and by technique. A learner drilling a specific primitive uses TECHNIQUES.md; one working through recent competitions uses the year directories.

Nothing tracks progress, which is now true of every non-sequential source here. The difficulty grades are the only scaffold, and they are a filter rather than a path.

Recorded weaknesses

No license. Same defect as adrianhajdin-uber-clone, and with more consequence: the archive redistributes competition binaries and other people’s challenge material, so the reuse terms matter to anyone forking it and are absent.

Solve counts are unsourced within the repo. They come from the original scoreboards; no method or citation for them is given here.

Coverage is what got competed on. An archive of past problems inherits the competitions’ taste — which bug classes were fashionable in a given year — not a considered map of the subject. This is the same popularity selection cs2023 exposed in the repository curricula, arriving by a different route.

No outcome data. Unchanged for the whole corpus. Nobody has shown that drilling past problems produces a competent kernel researcher.

Tier

T3. A maintainer-owned repository describing its own material, with no external review and no stated license. The solve counts raise it above the corpus’s marketing-number floor without making it a measured source.

problem-archive · capture-the-flag · interview-preparation · meta-curriculum · prompt-engineering-guide · coding-interview-university · cs2023 · mito753