MAccConc Exploring Linux Kernel Race Conditions with Control...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://projectzero.google/2026/09/maccconc-race-condition.html
• Blog Title: MAccConc: Exploring Linux Kernel Race Conditions with Controlled Memory-Access Interleavings
• Suggested Section: Generic Methodologies & Resources > Fuzzing Methodology, with a cross-reference from Binary Exploitation > Common Exploiting Problems or Linux kernel exploitation

🎯 Content Summary

Scope and security impact. This Google Project Zero post presents MAccConc, short for Memory Access Concurrency, a Linux-kernel research and testing toolkit for exploring thread interleavings. It is not a CVE advisory and does not disclose a specific CVE, CVSS score, confirmed vulnerability, or privilege-escalation exploit. Its purpose is to make difficult-to-reproduce concurrency behavior observable and repeatable. A race found with this workflow could become securi...

🔧 Technical Details

Memory-access communication-point discovery. Instrument a concurrent kernel with ASAN/KASAN outline callbacks using asan-instrumentation-with-call-threshold=0 and CONFIG_KASAN_OUTLINE, disable callback merging with asan-opt-same-temp, and optionally enable global-variable callbacks with asan-opt-globals. Route the callbacks through KCOV and compare accesses from different execution contexts. Overlapping ranges where at least one access is a write are candidate communication points; classify kfree() as a write so object-release interactions are included. KCOV remote coverage can extend the same analysis to background work such as packet processing and RCU callbacks.

Stable replay of race locations. Do not identify replay points only by heap address, because allocations change between runs, or only by instruction address, because generic helpers such as memcpy() and 🤖 Agent Actions

Updated src/generic-methodologies-and-resources/fuzzing.md with a new MAccConc section covering:

• KASAN/KCOV memory-access instrumentation
• Cross-context communication-point discovery
• Count-augmented stack identifiers
• KCOV_SET_DI scheduling actions
• Automatic A-B-A and interactive workflows
• Instrumentation limitations and future fuzzing applications
• Numbered citations to the Project Zero post, MAccConc repository, and KCOV documentation

Validation passed with git diff --check and citation/reference checks. mdbook was unavailable, so a full build was not run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://projectzero.google/2026/09/maccconc-race-condition.html

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources > Fuzzing Methodology, with a cross-reference from Binary Exploitation > Common Exploiting Problems or Linux kernel exploitation".

Repository Maintenance:

• MD Files Formatting: 1032 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0