kernelBinary Exploitation

Linux Kernel 7.0 Slub allocator: Sheaf-based exploitation

Preface

along with the linux kernel 7.0 update, the slab allocator has made a lot of changes like replacing the slab freelist layer with sheaves which is small arrays of object pointers, along with the performance improve, it also caused some mitgation fail and boundary check missing, making sheaf a new target to exploit.

this blog mainly talk about new techniques(concepts) to exploit sheaves.

Architecture

image

Allocation flow

image

for more detailed slub allocator 7.0 analyze:
https://zkltch.me/2026/09/03/Linux%20kernel%207.0%20Slub%20allocator%20analyze/

and our primary target is slab_sheaf

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
struct slab_sheaf {
        union {
                struct rcu_head rcu_head;
                struct list_head barn_list;
        };                              /* 0x00 */
        struct kmem_cache *cache;       /* 0x10 */
        unsigned int size;              /* 0x18 */
        int node;                       /* 0x1c */
        void *objects[];                /* 0x20 */
};

struct slub_percpu_sheaves {
        local_trylock_t lock;           /* 0x00 */
        struct slab_sheaf *main;        /* 0x08 */
        struct slab_sheaf *spare;       /* 0x10 */
        struct slab_sheaf *rcu_free;    /* 0x18 */
};

image

Mitgation failure

CONFIG_SLAB_FREELIST_HARDENED

back in 6.* the slub allocator use set_freepointer and get_freepointer to take the object pointer encoded with ptr ^ s->random ^ swab(ptr_addr) before alloc/free the object to freelist in fastpath

image

but in the new 7.0 slub allocator, added sheaf layers as fastpath and its implementation just directly alloc/free the object to it’s object pointer array of the sheaf

https://elixir.bootlin.com/linux/v7.0/source/mm/slub.c#L4671

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
static __fastpath_inline
void *alloc_from_pcs(struct kmem_cache *s, gfp_t gfp, int node)
{
 struct slub_percpu_sheaves *pcs;
 bool node_requested;
 void *object;

#ifdef CONFIG_NUMA
 if (static_branch_unlikely(&strict_numa) &&
    node == NUMA_NO_NODE) {

  struct mempolicy *mpol = current->mempolicy;

  if (mpol) {
   /*
    * Special BIND rule support. If the local node
    * is in permitted set then do not redirect
    * to a particular node.
    * Otherwise we apply the memory policy to get
    * the node we need to allocate on.
    */
   if (mpol->mode != MPOL_BIND ||
     !node_isset(numa_mem_id(), mpol->nodes))

    node = mempolicy_slab_node();
  }
 }
#endif

 node_requested = IS_ENABLED(CONFIG_NUMA) && node != NUMA_NO_NODE;

 /*
  * We assume the percpu sheaves contain only local objects although it's
  * not completely guaranteed, so we verify later.
  */
 if (unlikely(node_requested && node != numa_mem_id())) {
  stat(s, ALLOC_NODE_MISMATCH);
  return NULL;
 }

 if (!local_trylock(&s->cpu_sheaves->lock))
  return NULL;

 pcs = this_cpu_ptr(s->cpu_sheaves);

 if (unlikely(pcs->main->size == 0)) {
  pcs = __pcs_replace_empty_main(s, pcs, gfp);
  if (unlikely(!pcs))
   return NULL;
 }

 object = pcs->main->objects[pcs->main->size - 1];

 if (unlikely(node_requested)) {
  /*
   * Verify that the object was from the node we want. This could
   * be false because of cpu migration during an unlocked part of
   * the current allocation or previous freeing process.
   */
  if (page_to_nid(virt_to_page(object)) != node) {
   local_unlock(&s->cpu_sheaves->lock);
   stat(s, ALLOC_NODE_MISMATCH);
   return NULL;
  }
 }

 pcs->main->size--;

 local_unlock(&s->cpu_sheaves->lock);

 stat(s, ALLOC_FASTPATH);

 return object;
}

literally just pop the object from main sheaf

1
2
object = pcs->main->objects[pcs->main->size - 1];
pcs->main->size--;

CONFIG_SLAB_FREELIST_HARDENED does not apply to sheaf layer

CONFIG_SLAB_FREELIST_RANDOM

back in 6.* it was used to randomize the slab layout so the attacker cant predict the address next object allocate
image

but in linux kernel 7.0 this only apply to slowpath which is kmem_cache->offset (pointintg to a slab freelist)
and not apply to sheaf layer

double free check

a bit similar to the root cause of CONFIG_SLAB_FREELIST_HARDENED
the reason why double free check is also failed for sheaf layer is that it also dont use set_freepointer to free the object to sheaf object pointer array

the set_freepointer function will encode the pointer and detecting the double free/memory corruption

set_freepointer()

https://elixir.bootlin.com/linux/v7.0/source/mm/slub.c#L537

1
2
3
4
5
6
7
8
9
10
11
static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp)
{
 unsigned long freeptr_addr = (unsigned long)object + s->offset;

#ifdef CONFIG_SLAB_FREELIST_HARDENED
 BUG_ON(object == fp); /* naive detection of double free or corruption */
#endif

 freeptr_addr = (unsigned long)kasan_reset_tag((void *)freeptr_addr);
 *(freeptr_t *)freeptr_addr = freelist_ptr_encode(s, fp, freeptr_addr);
}

as for sheaf implementation

free_to_pcs()

https://elixir.bootlin.com/linux/v7.0/source/mm/slub.c#L5763

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
static __fastpath_inline
bool free_to_pcs(struct kmem_cache *s, void *object, bool allow_spin)
{
 struct slub_percpu_sheaves *pcs;

 if (!local_trylock(&s->cpu_sheaves->lock))
  return false;

 pcs = this_cpu_ptr(s->cpu_sheaves);

 if (unlikely(pcs->main->size == s->sheaf_capacity)) {

  pcs = __pcs_replace_full_main(s, pcs, allow_spin);
  if (unlikely(!pcs))
   return false;
 }

 pcs->main->objects[pcs->main->size++] = object;

 local_unlock(&s->cpu_sheaves->lock);

 stat(s, FREE_FASTPATH);

 return true;
}

the way sheaf free object just pcs->main->objects[pcs->main->size++] = object push the object back to the main sheaf object pointer array without any double free/memory corruption checking

Techniques

the below techniques based in theory only showing the capable of it
in real exploit of these technqiues needs a lot more:

  • the bug itself: heap overflow or UAF in a kmalloc bucket that hold a sheaf struct
  • heap spray against CONFIG_RANDOM_KMALLOC_CACHES
  • KASLR leak
  • more…

Technique 1 - Object pointer array hijack

since CONFIG_SLAB_FREELIST_HARDENED and CONFIG_SLAB_FREELIST_RANDOM doesnt apply to sheaf object pointer array
so we can just hijack the next pop pointer
to achieve arbitrary alloc/write

  • example: if u already knew kernel base address then just overwrite next object that will be allocated to the address of modprobe_path
    imageimage

after got the hijacked object(modprobe_path) from kmem_cache_alloc() or kmalloc then just overwrite it to ur file path of binary/bash script
trigger request_module and run the binary/bash script you provided with root

Technique 2 - Out of bound free/write

https://elixir.bootlin.com/linux/v7.0/source/mm/slub.c#L404

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
struct slab_sheaf {
 union {
  struct rcu_head rcu_head;
  struct list_head barn_list;
  /* only used for prefilled sheafs */
  struct {
   unsigned int capacity;
   bool pfmemalloc;
  };
 };
 struct kmem_cache *cache;
 unsigned int size;
 int node; /* only used for rcu_sheaf */
 void *objects[];
};

the size variable is used to control the index of object array

no boundary check for size , only check if the size is full

https://elixir.bootlin.com/linux/v7.0/source/mm/slub.c#L5763

1
2
3
4
5
6
7
8
9
10
11
12
static __fastpath_inline
bool free_to_pcs(struct kmem_cache *s, void *object, bool allow_spin)
{
 ...
 if (unlikely(pcs->main->size == s->sheaf_capacity)) {
  ...
 }
 pcs->main->objects[pcs->main->size++] = object;
 ...

 return true;
}

by corrupting the size to make the slub allocator free where it pointing to

  • example: out of bound free a object with fake cred struct
    image
    image

Technique 3 - Out of bound alloc infoleak

if we can do oob free we can do oob alloc too by corrupting the size field and try oob alloc surround heap struct that contains kernel pointer

  • example: if fd_array is around the corrupted object , we can oob alloc one of file struct and read the f_op field which contains .rodata pointer to defeat KASLR
    image
    image

Technique 4 - Out of bound alloc leakless LPE

same primitive but write instead of read
by writing

  • this example is basically as same as technqiue 3 but this time spraying open("/etc/passwd", O_RDONLY) and heap oob alloc first
1
2
for (i = 0; i < 512; i++)
        fd[i] = open("/etc/passwd", O_RDONLY);   /* 512 x struct file * */

after that instead of read .rodata pointer we overwrite the f_mode which is the permission flag of that file to 0x40012: FMODE_WRITE | FMODE_PWRITE | FMODE_CAN_WRITE
so we can write /etc/passwd without root
image
image

References

https://zkltch.me/2026/09/03/Linux%20kernel%207.0%20Slub%20allocator%20analyze/
https://duasynt.com/blog/linux-kernel-heap-feng-shui-2022
https://slavin.cn/2024/05/06/Slub-allocator-%E5%88%86%E6%9E%90/
https://fosdem.org/2026/events/attachments/DPXVYJ-slub-sheaves-update/slides/267397/fosdem-sh_pvi6fpf.pdf
https://elixir.bootlin.com/linux/v7.0/source/mm/slub.c
https://elixir.bootlin.com/linux/v7.0/source/include/linux/slab.h
https://naup.mygo.tw/2026/08/22/Harvest-Season-For-Slub/