PrimSynth: An Agentic Approach to Discover, Validate, and Synthesize Exploit Primitives for Linux Kernel Vulnerabilities

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

1

P RIM S YNTH: An Agentic Approach to Discover, Validate, and Synthesize Exploit Primitives for Linux Kernel Vulnerabilities Pengfei Wang1 , Anying Chen2 , Danjun Liu1 , Xu Zhou1 , Wei Xie1

arXiv:2609.02647v1 [cs.CR] 2 Sep 2026

1. National University of Defense Technology, 2. Clouditera

Abstract—Linux kernel vulnerabilities are critical to downstream systems. Despite extensive research on automated kernel exploitation, a fundamental challenge remains the conceptual gap between abstract exploit strategies and concrete technical operations. To fill this gap, this paper introduces a systematic characterization that formalizes six classes of exploit primitives from logical capability to validatable effect. Then, an extended exploit strategy representation is proposed, which couples primitive upgrading strategies with primitive path code synthesis rules governing object constraints, temporal sequencing, environment prerequisites, and validation constraints. Building upon this foundation, this paper presents P RIM S YNTH, a multi-agent framework that encapsulates these representations through coordinated agents to discover, validate, and synthesize exploit primitives for memory corruption vulnerabilities in the Linux kernel. These agents operate in an iterative closed loop until valid primitives are found, leveraging validation signals as evidence of exploitable state transitions to ground primitive synthesis decisions. An automated method for extracting and validating primitives is also proposed based on vulnerability-directed execution and a rebootable validation environment. P RIM S YNTH is evaluated on 16 real-world Linux kernel CVEs spanning 5 vulnerability types. Experimental results show that P RIM S YNTH achieves reliable primitive extraction, maintaining a 100% primitive match rate. For primitive synthesis, P RIM S YNTH successfully synthesizes multi-primitive exploitation chains with 82.4% strategy synthesis rate (SSR) when the public PoC is available and a 61.3% SSR without the guidance of primitive hypotheses. For efficiency, P RIM S YNTH completes end-to-end primitive synthesis in 72.4s on average, significantly outperforming semi-automated analysis or manual analysis that require hours to days. Index Terms—Exploit primitive, automated exploit generation, primitive extraction, primitive synthesis.

I. I NTRODUCTION The Linux kernel serves as the upstream source for all open-source or commercial distributions, and its security vulnerabilities propagate into downstream systems governing cloud infrastructure, web services, and embedded devices. Therefore, research on systematic reproduction and automated exploitability assessment of kernel vulnerabilities is proliferating [1]–[3]. Automated exploitation of the Linux kernel has been a longstanding open problem. The main challenge lies in the gap between the conceptual exploit strategies and the procedurally technical operations. Much of this diverse and nuanced knowledge resides only in the minds of human experts. To bridge the knowledge gap in Linux kernel exploitation techniques, the concept of exploit primitives has been proposed. An exploit primitive refers to a program state that violates security requirements and enables an attacker to gain capabilities beyond

those provided by the original program. By providing a unified and formal framework, exploit primitives make vulnerability exploitation analysis more systematic and comparable. Current research on exploit primitives typically targets a single vulnerability type or a single exploitation phase. As a result, operations used to realize one primitive are difficult to transfer into reproducible primitives in subsequent chainable phases. In addition, prior research on primitive mainly emphasizes target-object discovery and heap layout manipulation, but lacks a general validation methodology that can reliably localize candidate primitives and support further identification and extraction. Existing primitive analysis tends to focus on vulnerability-triggering paths, while the broader impact and composability of reproducible primitives are rarely evaluated because such assessments are labor-intensive. Although fast-growing LLM (Large Language Model) driven agents can generate PoCs for specific vulnerabilities [4], the process is consumptive, and the results are unstable without formal guidance on primitive composition. Therefore, automated exploit generation (AEG) still faces challenges due to the lack of: (i) systematic characterization of validated and potential primitives; (ii) a general method to determine primitive availability for specific Linux kernel versions; and (iii) retrospective understanding of strategic primitive synthesis at different sophistication levels. This gap motivates three research questions: (1) How to classify and model the primitives in the general exploitation stage? (2) How to accurately and reliably extract exploit primitives for memory corruption vulnerabilities in the Linux kernel? (3) How to synthesize and chain primitives automatically? In this paper, we reformulate the end-to-end code generation problem into a primitive path optimization problem, iteratively discovering, validating, and synthesizing known and previously unknown primitives until finding solvable path and capable program states, merging the hard-coded patterns of known exploit primitives and the unshaped code paths into agentic primitives in concrete validation environments to reach reproducible and composable confirmation in the agentic loops. To do so, we propose a tool-augmented multi-agent framework named P RIM S YNTH to automatically discover, validate, synthesize, and chain exploit primitives. The framework couples five executable units: (i) vulnerability-directed execution based on directed fuzzing; (ii) LangChain-based agent orchestration for plan → tool selection → action → critique → feedback cycles; (iii) MCP-accessible tool adapters for observation, validation, and synthesis; (iv) a knowledge base that stores structural vulnerability facts for primitive analysis based on the knowledge graph; and (v) a rebootable validation environment built from QEMU and instrumented

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

kernel images for specific target versions. P RIM S YNTH is extensively evaluated on 16 real-world Linux kernel CVE vulnerabilities, the results demonstrate a strategy synthesis rate (SSR) of 82.4% with public PoC guidance and 61.3% without, achieving 77.1% overall with an average runtime of 72.4 seconds. These results have three key implications for automated kernel exploitation research. First, the strong performance under incomplete information validates that P RIM S YNTH’s iterative validation feedback mechanism effectively compensates for the absence of prior guidance, enabling practical zero-day analysis. Second, the interactive timescale (under 75 seconds) positions primitive synthesis as a usable tool for real-time security assessment workflows. Third, the successful synthesis of multi-step primitive chains across diverse vulnerability classes demonstrates that agentic approaches combining LLM-based reasoning with dynamic validation can achieve practical performance on vulnerability exploitability evaluation. The main contributions of this work are as follows: • We propose a systematic characterization (modeling, classification, and formalization) of exploit primitives, grounded by their identical capability or strategy pattern, which facilitates agent-based automatic primitive identification and synthesis. • We develop an automated method for identifying and validating primitives based on vulnerability-directed execution and a rebootable validation environment, which improves candidate objects grounding and accumulated primitive reproduction by path exploration under incomplete information. • We design and implement P RIM S YNTH , a toolaugmented multi-agent framework with iterative feedback loops to discover, validate, and synthesize multiprimitive paths beyond single-class primitive settings. An anonymous artifact package is available at: https: //anonymous.4open.science/r/PrimSynth-8B7A. • We evaluate P RIM S YNTH on 16 real-world Linux kernel CVE vulnerabilities across 5 types. Results show that P RIM S YNTH achieves reliable primitive extraction, maintaining 100% primitive match rate (PMR). For primitive synthesis, P RIM S YNTH successfully synthesizes multiprimitive exploitation chains with 82.4% SSR when the public PoC is available and a 61.3% SSR without public PoC guidance. As for efficiency, P RIM S YNTH completes end-to-end primitive synthesis in 72.4s on average, significantly outperforming semi-automated analysis or manual analysis that require hours to days. II. BACKGROUND AND M OTIVATION Exploit Primitive Definition. In 2018, Branco et al formalized the definition of exploit primitive (EP) as an attack capability that an attacker can potentially achieve from a security vulnerability [5]. They defined five major primitive properties in this model: arbitrary addresses, arbitrary content, arbitrary operation, arbitrary number of times, and at arbitrary time. However, such definitions are too loose to implement in real-world applications. Google Project Zero [6]

2

later refined this definition in 2020, emphasizing the generality aspect of an exploit primitive: “A capability granted during an exploit that is reasonably generic.” Accordingly, the exploit strategy is the low-level, vulnerability-specific method used to turn the vulnerability into a useful exploit primitive, and the corresponding exploit technique is a reusable and reasonably generic strategy for turning one exploit primitive into another (usually more useful) exploit primitive. Unlike userland exploitation that targets a single process, kernel exploitation breaks the Ring 3/Ring 0 isolation barrier to gain system-wide access. Characterizing primitive impacts remains challenging even with validation support. Prior Primitive Studies and Their Limitations. A rich body of work has studied exploitation primitives that form the building blocks of kernel exploits. On the target object identification front, ELOISE [7] systematically studied elastic objects as versatile exploitation targets, AlphaEXP [8] developed an expert system for identifying security-sensitive kernel objects, SCAVY [9] automated the discovery of memory corruption targets for privilege escalation, and Liu et al. [10], [11] studied freed object reuse and arbitrary write primitives via puppet objects. On the heap manipulation front, SLAKE [12] provided systematic techniques for slab manipulation, K(H)eaps [13] studied exploit reliability, DirtyCred [14] proposed credential swapping for privilege escalation, and RetSpill [15] demonstrated igniting user-controlled data on the kernel stack. Maar et al. [16] demonstrated reliable exploits via defense-amplified TLB side-channel leaks. Motivation. Although prior work has made substantial progress on individual exploitation techniques, these studies still leave a fundamental gap for exploitability analysis: exploit primitives are usually discovered, validated, and synthesized in isolation, and the resulting methods are tightly coupled to a specific vulnerability class, subsystem, or proof-of-concept. In practice, kernel exploitation is a chain of dependent capabilities. A tester must first localize a reachable vulnerabilitytriggering path, then identify a realizable primitive under the target environment, and finally compose multiple primitives into a valid exploitation sequence. However, existing approaches rarely provide a unified way to model primitive capability, environment prerequisites, temporal constraints, and validation evidence in one framework. As a result, they can often indicate whether a bug is exploitable in principle, but they cannot reliably answer which primitive is available, how it can be validated, or how multiple primitives can be composed across different kernel versions and execution contexts. This limitation is especially severe for memory-corruption vulnerabilities, where heap layout, object lifetime, race timing, and mitigation state all affect feasibility. Motivated by this gap, we develop P RIM S YNTH, a framework that automatically discovers candidate primitives, validates them against concrete execution evidence, and synthesizes reusable primitive chains under both PoC-guided and PoC-free settings. III. E XPLOIT P RIMITIVE C HARACTERIZATION A. Formal Representation of Exploit Primitive We use exploit primitives as intermediate abstractions between bug triggers and end-to-end exploits. To identify prim-

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

3

TABLE I F ORMAL R EPRESENTATION OF E STABLISHED P RIMITIVE C LASS Primitive Types Out-of-Bounds Use-After-Free Double-Free Arbitrary-Write Control-Flow-Hijacking Info-Leak

Formal Representation ∃ alloc(s, size) ∧ UserControllable(size) ∧ Reachable(alloc, syscall) ∧ StructType(s, T ) ∃ alloc(s) ∧ ∃ free(p) ∧ Alias(p, s) ∧ ∃ use(p′ ) ∧ Alias(p′ , s) ∧ TemporalOrder (free, use) ∧ Reachable(alloc, syscall) ∧ Reachable(use, syscall) ∃ alloc(s) ∧ ∃ free 1 (p1 ) ∧ ∃ free 2 (p2 ) ∧ Alias(p1 , s) ∧ Alias(p2 , s) ∧ free 1 (p1 ) ̸= free 2 (p2 ) ∧ Reachable(free 1 (p1 ), syscall) ∧ Reachable(free 2 (p2 ), syscall) ∃ alloc(s) ∧ ∃ copy(to, from, len) ∧ (PointsTo(to, s) ∨ FromField(to, s, offset)) ∧ (FromField(len, s, offset l ) ∨ FromField(to, s, offset t )) ∧ Reachable(copy, syscall) ∃ alloc(s) ∧ ∃ call(f ptr) ∧ FromField(f ptr, s, offset) ∧ IsFunctionPtr (f ptr) ∧ Reachable(alloc, syscall) ∧ Reachable(call, syscall) ∧ ControllableParams(call, ≥ 2) ∃ alloc(s) ∧ ∃ leak (src, dst) ∧ (PointsTo(src, s) ∨ FromField(src, s, offset)) ∧ Reachable(alloc, syscall) ∧ Reachable(leak , syscall)

itives through their identical objects or gadget patterns which constitute the general capabilities, we propose a systematic framework. Each primitive type exhibits distinct characteristics that can be statically identified through program analysis techniques provided in related works [10], [17], [19]. We use the following notation: the predicate alloc(s, size) denotes an allocation operation creating object s with size size, while free(p) denotes a de-allocation operation on pointer p. The relation Alias(p1 , p2 ) indicates that pointers p1 and p2 alias the same memory object, and PointsTo(p, s) indicates that pointer p points to object s. The predicate FromField (v, s, offset) indicates that value v originates from the field at offset in object s. The predicate Reachable(op, syscall ) indicates that operation op is reachable from a system call entry point, while TemporalOrder (op1 , op2 ) indicates that operation op1 occurs before op2 in execution order. Finally, UserControllable(v) indicates that value v is derived from user input. Building on existing sanitization and object analysis techniques, we classify six primitive types prevalent in Linux kernel exploitation: Out-of-Bounds (OOB), Use-After-Free (UAF), Double-Free, Arbitrary-Write, Control-Flow-Hijacking (CFH), and Info-Leak. Table I presents their formal representations as logical predicates over memory operations, control flow, and data dependencies. B. Extended Exploit Strategy Representation Table I defines the six primitive types as logical predicates (the capability view). For primitive reproduction, we further define a strategy contract (the execution view) that binds those predicates to step-wise constraints, validation signals, and code-generation actions. A strategy is represented as: S = ⟨P, B, K, V, G, A⟩. Where, P = [p1 , . . . , pn ] is an ordered primitive chain; B = [Ψ1 , . . . , Ψn−1 ] is a set of primitive path code synthesis rules, where each Ψi defines how to generate executable path code snippets between consecutive primitives grounded in candidate objects from K; K is the discovery-side knowledge tuple (entry syscalls, reachable paths, object priors, and environment gating); V is the validation oracle tuple (humanfriendly observable outcomes and machine-readable validation signals); G is the synthesis tuple (step-level facts and code templates/strategy constraints); and A is the final exploit artifact tuple (generated code plus evidence log).

Identical Object Elastic Object [7] Freed Object [10], [11] Multiply-Freed Object [10] Bridge/Router Object [11], [17] Puppet Object [11] Disclosure Object [18]

For each primitive transition pi → pi+1 , a primitive path code synthesis rule is defined as : ∧ Ψtime Ψi = Ψobj ∧ Ψenv ∧ Ψsig i i i i , specifies which candidate where the object constraint Ψobj i objects (e.g., msg_msg, pipe_buffer) and their field offsets are required in the synthesized code; the temporal constraint Ψtime defines the allocation/free/reuse sequence timing i required for heap manipulation primitives; the environment constraint Ψenv captures kernel version, mitigation status, i and runtime prerequisites for code execution; the validation constraint Ψsig enforces minimum signals that confirm the i synthesized code achieves the expected primitive capability. Code generation proceeds only when Ψi is satisfied, ensuring each synthesized step is grounded in validated candidate objects rather than abstract transitions. Each extracted primitive is validated through machineobservable validation signals (will discuss in detail in Section IV-C) generated by primitive identification, debugging, or compilation tools. Among them, we use struct layouts and field offsets provided by the static tool PODE [11] to select objects; Then, we confirm actual memory corruption by semantics and offsets provided by memory error reports such as KASAN; For timing control, we track the complete object lifecycle through debugger watchpoints to verify heap manipulation sequences; For path reachability, we capture and analyze the execution trace from syscall entry to vulnerability location, and check the security boundary conditions; Finally, to confirm success, we detect intermediate achievements and verify final exploitation outcomes. If validation fails, the system adapts: mismatched object offsets trigger re-hypothesization, failed timing sequences lead to parameter adjustment, unreachable paths require entry point modification, and missing achievement signals necessitate chain redesign. C. Representation Mappings for Agent Pipeline To connect strategy representation with the agent pipeline, we define three mappings that ground code path synthesis in concrete validation and generation: Discovery mapping MD : q 7→ K, populates the knowledge tuple K with candidate objects (e.g., msg_msg, pipe_buffer), step hypotheses with reference primitives, and validation signals for primitive path code synthesis rules; Validation mapping MV : (P, B, K) 7→ V, verifies that primitive path code synthesis rules (Ψi ∈ B) are satisfied by

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

4

Fig. 1. Overview workflow of P RIM S YNTH framework

concrete candidate objects through validation signals (S1–S9), producing the validation oracle tuple V; Synthesis mapping MS : (P, B, K, V) 7→ (G, A), instantiates validated primitive path code synthesis rules into executable code patterns stored in G, generating the artifact tuple A containing synthesized exploit code grounded in validated candidate objects. We separate reusable strategy skeletons from environmentspecific bindings. The reusable part is captured in (P, B, G), while kernel-version and subsystem-dependent factors are isolated in environmental primitive path code synthesis rules (i.e., Ψenv ) and re-checked by MV for each case. Hence, the same i strategy can be adapted across Linux versions/subsystems with re-validation of environment-specific constraints IV. D ESIGN OF P RIM S YNTH F RAMEWORK A. Overview P RIM S YNTH is a unified, agent-driven framework for reproducible primitive analysis and synthesis. As Figure 1 shows, the framework executes a three-stage agent pipeline— Discovery, Validation, and Synthesis—and closes the loop through structured validation feedback. The Discovery agent collects facts and contexts. It performs fact retrieval and knowledge construction to collect affected software/version, weakness type, patch reference, vulnerability locations, primitive-type priors, and reproducibility context. The reproducibility context usually contains claimed reproducible PoC code, vulnerability-triggering input, or a demonstration image with a vulnerable version of the Linux kernel. The Validation agent confirms feasibility and gathers evidence. It first performs primitive identification using vulnerability-directed execution to derive the vulnerabilitytriggering path and identify candidate objects with primitive hypotheses along the vulnerability-triggering path. Then, it performs primitive validation to verify semantic correctness

and reproducibility of the primitive hypotheses with toolassisted execution. The Synthesis agent composes validated primitives into exploit code. It first performs primitive extraction to extract primitive path code snippets from the candidate objects. Then it leverages strategic synthesis to compose path code snippets into exploit code artifacts based on the primitive path code synthesis rules. The agent collaboration loop is organized as plan → tool selection → action → critique → fallback. Given a query (typically a CVE ID), the Discovery Agent first materializes Vulnerability Location Marks from the procedure of fact retrieval and knowledge construction. Then the Validation Agent schedules identification and validation actions to derive candidate objects and primitive paths. After that, the Synthesis Agent uses the procedure of primitive extraction to consolidate the validated primitive paths into code snippets, and strategic synthesis composes the primitive path code snippets to exploit code artifacts. The core procedure is abstracted as vulnerability location marks → vulnerability-triggering path → candidate objects → primitive hypotheses → validated primitive paths → primitive path code snippet → multiprimitive exploit code. The loop maintains iteration-level state observables and failure-inducing feedback (e.g., unreachable path, invalid strategy, or weak observable signal), which guides targeted recovery instead of restarting from scratch. This closed-loop design ensures that primitive hypotheses are accepted only if they satisfy both structural plausibility and execution-level evidence. B. Factual Knowledge Discovery The Discovery Agent operates through a structured twophase procedure to transform raw vulnerability reports into actionable knowledge structures. 1) Fact Retrieval. The Discovery Agent employs hybrid information extraction techniques combining structured parsing

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

with semantic web search. It systematically queries security databases (CVE, NVD, security advisories), version control repositories, and patch archives to extract affected software identities, version ranges, CWE classifications, and reference materials including official patches, commit diffs, and vendor security bulletins. A keyword-based web retrieval in this phase ensures comprehensive coverage of vulnerability artifacts. 2) Knowledge Construction. The Discovery Agent synthesizes retrieved facts into a unified knowledge graph representation tailored for downstream primitive analysis. This process involves entity resolution to normalize software names and version notations, relation extraction to establish dependencies between vulnerability locations and affected components, and schema alignment to map unstructured facts (PoC snippets, crash reports, procedural illustration) into structured reproducibility context. The constructed knowledge base encodes vulnerability-triggering conditions, entry point locations in source code, and primitive-type priors derived from historical patterns, forming a queryable foundation that enables the Validation and Synthesis agents to perform targeted primitive identification and strategic composition. Concretely, the Discovery Agent outputs a normalized case profile including: (i) vulnerability facts (affected range, weakness class, patch references), (ii) candidate entry syscalls and vulnerable locations, (iii) identified step-wise primitives, and (iv) environment-gating requirements. These outputs are scored with confidence tags, so downstream components can distinguish high-certainty anchors from speculative hypotheses. When the Validation agent reports a contradiction (e.g., path mismatch or missing validation signal), the Discovery agent re-ranks candidates and updates the profile without discarding confirmed facts. C. Primitive Identification and Validation The Validation Agent first identifies the candidate objects along the vulnerability-triggering path, then it collects the corresponding primitive hypotheses and verifies their semantic/syhtactic correctness and reproducibility with tool-assisted execution to derive validated primitive paths. 1) Primitive Identification: the Validation Agent consumes vulnerability location marks and generates directed fuzzing campaigns to correctly activate the expected vulnerabilitytriggering path. It first instruments the vulnerability location marks as the objective of directed fuzzing campaigns, then enumerates primitive hypotheses by identifying and grouping the prerequisite operations on reached objects. These operations include allocation/free/use relations and functionpointer invocation. After that, the agent identifies the candidate objects along the vulnerability-triggering path and collects the primitive hypotheses for these objects. The output of this procedure is a ranked set of primitive hypotheses, candidate objects, and expected side effects. 2) Primitive Validation: the agent evaluates each primitive hypothesis for semantic/syhtactic correctness and path reachability through machine-observable validation signals generated by primitive identification, debugging, or compilation tools. Specifically, including the following 9 validation signals across three layers:

5

KASAN Layer: Memory error reports providing corruption semantic and offsets (S1) and execution trace from syscall entry to vulnerability location(S2); • Debugger Layer: Runtime state observation via dbgtool capturing complete object lifecycle (S3), security boundary conditions(S4), intermediate achievement (S5), and final exploitation outcome (S6); • Static Layer: LLVM-based analysis via PODE [11] providing object layout and field offsets (S7), alias relation (S8), and pointer instruction recognition (S9). These validation signals are aggregated into observable outcomes for the user interface, including: • confirmed (all primitive path code synthesis rules Ψi satisfied by candidate objects); sig • partial (some Ψi met but Ψobj or Ψtime pending); i i • rejected (signal mismatches candidate objects detected). It is noteworthy that execution trace (S2) and static analysis results (S7–S9) primarily serve as synthesis inputs that feed into the Synthesis Agent’s primitive extraction and upgrading strategy selection. Machine-readable failure reasons directly drive fallback policies: unreachable paths trigger Discoveryside path revision, while signal mismatches trigger Synthesisside strategy rewrites. If current primitive hypotheses are unreachable, syntactically inconsistent, or semantically incorrect in the validation environment, the loop falls back to knowledge discovery and revises the reproducibility context while preserving already validated evidence. The output of this procedure is a set of validated primitive paths. •

D. Primitive Extraction and Synthesis After validation, the Synthesis Agent extracts primitive path code snippets from the candidate objects with the validated primitive paths. Then it leverages strategic synthesis to compose path code snippets into multi-primitive exploit code artifacts based on the primitive path code synthesis rules. 1) Primitive Extraction: consolidates confirmed operation slices into reusable primitive path code snippets with primitive path code synthesis rules (Ψi ) governing how to compose executable code between consecutive steps. This step transforms noisy traces into a compact strategy-ready representation and removes transitions unsupported by validation signals. 2) Strategic Synthesis: composes primitive path code snippets through an execution-grounded synthesis loop. Step 1: Signal Acquisition: KASAN reports capture S1 (memory corruption), execution traces capture S2 (path hits i.e., control flow reachability as the syscall trace leading to the crash), and dbg-tool watchpoints capture S3 (object lifecycle). The dbg-tool framework enables precise observation through memory watchpoints, object lifecycle tracking, and crash evidence capture, providing the validation signals required for confirming primitive path code synthesis rules. Step 2: Synthesis Rule Validation: each primitive path must satisfy primitive path code synthesis rules Ψi = Ψobj ∧ i sig env Ψtime ∧ Ψ ∧ Ψ grounded in candidate objects. For i i i example, a Step 1 OOB rule Ψ1 requires S2 signals confirming corruption of candidate object msg_msg headers (Ψobj 1 satisfied), while a Step 2 Info-Leak rule Ψ2 requires S4

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

6

signals confirming disclosure through msgrcv() paths (Ψsig 2 satisfied). Step 3: Code Generation: upon Ψi satisfaction (all object, temporal, environment, and validation constraints met), template-based instantiation reuses code patterns from G bound to validated primitive path and candidate objects; if sig(unknown candidate object nals indicate under-specified Ψobj i fields), strategy-guided path exploration via LLM generates alternative primitive paths targeting different candidate objects (e.g., sk_buff replacing msg_msg) for iterative validation. Generated code artifacts are re-injected into the Validation Agent, forming an execution-grounded synthesis loop. 3) Signal-driven Strategy Selection: The Synthesis Agent implements a dynamic policy that selects between templatebased and strategy-guided generation based on validation signals captured by tools, with S7–S9 serving as object-grounded constraints that determine primitive upgrading feasibility. The upgrading strategies (e.g., OOB → InfoLeak → ArbitraryWrite) are selected and instantiated based on S7–S9 signals that identify which object transitions are structurally feasible. Template-based generation: When KASAN reports confirm both S1 signals (memory corruption at expected candidate object offsets) and S2 signals (syscall trace hitting vulnerability locations), and dbg-tool watchpoints capture S3 signals (allocation-free-reuse matching candidate object assumptions), the system performs template instantiation from G. This path requires all primitive path code synthesis rules time Ψi = Ψobj ∧ Ψenv ∧ Ψsig to be satisfied by validation i i ∧ Ψi i signals on known candidate objects. Strategy-guided Generation: When GDB observations reveal incomplete S3 signals (missing candidate object lifecycle events), or KASAN reports show inconsistent S1 patterns (corruption at unexpected candidate object offsets) or incomplete S2 traces (unreachable paths for candidate objects), the Synthesis Agent falls back to LLM-based path exploration to generate iterative primitive paths to different candidate objects. This procedure iteratively discovers new candidate objects and accumulates signals—from initial S2 detection on experimental objects through S3 state establishment to S5 completion—until sufficient Ψsig thresholds are met and new i primitive path code synthesis rules can be promoted into G. The Synthesis Agent monitors Ψsig at each step transition, i automatically decides a strategy when signal mismatches on candidate objects occur (e.g., KASAN offset deviations on msg_msg, dbg-tool allocation misses for pipe_buffer, trace deviations), maintaining synthesis robustness across diverse vulnerability contexts.

validation environment built from QEMU and instrumented kernel images. Vulnerability-directed Execution Runtime execution is implemented based on directed fuzzing (i.e., SyzDirect [20]). It takes vulnerability location marks into instrumentation points and mutation objectives, then schedules directed campaigns to activate the vulnerability-triggering path validation. The system prioritizes location-directed fuzzing campaigns to attain accurate path triggering. MCP-based Toolset. All analyzers and validators are exposed as MCP-style tools, including knowledge access, data extraction, validation, and synthesis interfaces, and can be attached from either in-environment or external runtimes. The current tools capture validation signals while keeping the MCP interface open for additional observers and validators. In our implementation, orchestration supports timeout/retry policy, confidence-aware tool selection, and signal-based aggregation for final step decisions. Knowledge Base. The knowledge base stores both static and dynamic evidence based on Neo4j. Static entries include vulnerability facts, patch diffs, coarse-grained vulnerability locations, reusable strategy representations, and primitive path code synthesis rules; dynamic entries include runtime observables, validation outcomes, and bridging strategies extracted from prior iterations. To support cross-case transfer, strategy tuples are indexed by primitive-centric step pattern and object/temporal/environment signatures. During synthesis, template lookup from G is jointly conditioned on primitivecentric step, object constraints, and signal-based evidence. Selected code templates or strategy prompts are materialized as versioned generation context so intermediate synthesis outputs can be reproduced, compared, and rolled back iteratively. Rebootable Validation Environment. The rebootable environment is built with QEMU and prebuilt instrumented kernel images for specific target versions, using deterministic boot parameters and controllable mitigation settings. Each iteration begins from a clean snapshot and records execution artifacts (kernel logs, KASAN reports, trace events, and debugger checkpoints). On failure, the environment can be reset and replayed with adjusted strategy parameters while preserving iteration history and evidence memory. This rebootable design is also used during synthesis for single- and multiple-primitive validation: intermediate synthesized PoC code are repeatedly replayed in the same kernel image to verify that validation signals confirm primitive path code synthesis rules (Ψi ) are satisfied by target candidate objects before transfer into later steps.

V. I MPLEMENTATION

VI. E VALUATION

We implement P RIM S YNTH as a tool-augmented multiagent system with unified callable interfaces and persistent case-level states. The implementation couples five executable layers: (i) vulnerability-directed execution based on directed fuzzing; (ii) LangChain-based agent orchestration; (iii) MCPaccessible tool adapters for observation, validation, and synthesis; (iv) a knowledge base that stores structural vulnerability facts based on the knowledge graph. and (v) a rebootable

To evaluate P RIM S YNTH, we conduct experiments on the automated discovery, validation, and synthesis of exploit primitives, aiming to address four research questions: RQ1 (Primitive Extraction Accuracy): How effective is the primitive identification and extraction method? RQ2 (Synthesis Utility): Can P RIM S YNTH synthesize the initial primitive and upgraded primitives into executable and semantically-correct code?

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

7

TABLE II CVE B ENCHMARK USED IN THE EVALUATION1 CVE ID CVE-2022-2588 CVE-2022-0995

Vuln. Type UAF OOB

Vuln. Location struct cls_route_filter struct watch_queue

EPSS 0.54 0.28

PoCs ✓ ✓

Env. Conditions CONFIG_NET_SCHED, 2+ CPUs CONFIG_WATCH_QUEUE, KASLR on

✓ ✓ ✓ × ✓

CONFIG_IO_URING, KASLR on CONFIG_XFRM_MIGRATE CONFIG_NF_TABLES CONFIG_USB, SMEP/SMAP off CONFIG_FS_CONTEXT

✓

CONFIG_NF_TABLES, libmnl

0.01 0.01 0.01 0.005 0.002

Primitive Ref. UAF→DF→ArbWrite OOB→InfoLeak→ArbWrite →CFH UAF→InfoLeak→ArbWrite OOB→UAF→ArbWrite UAF→InfoLeak→ArbWrite OOB IntOF→OOB→InfoLeak →ArbWrite IntOF→OOB→InfoLeak →CFH IntOF OOB→InfoLeak→CFH OOB→InfoLeak→ArbWrite OOB→UAF→CFH UAF→DF→InfoLeak→CFH

CVE-2022-1043 CVE-2019-15666 CVE-2022-32250 CVE-2024-53197 CVE-2022-0185

UAF OOB UAF OOB IntOF→OOB

struct io_uring struct xfrm_policy struct nft_set_elem struct usb_host_config struct fs_parameter

0.19 0.05 0.02 0.02 0.02

CVE-2022-1015

IntOF

struct nf_tables

0.01

CVE-2022-2639 CVE-2021-42008 CVE-2022-27666 CVE-2022-25636 CVE-2021-22600

IntOF OOB OOB OOB DF

CVE-2025-38477 CVE-2026-23427 CVE-2024-39486

Race→UAF UAF Race→UAF

struct sw_flow_actions struct sixpack struct skcipher_walk struct flow_rule struct packet_ring_buffer struct qfq_aggregate struct ksmbd_tree_conn struct inet6_dev

× ✓ ✓ ✓ ✓

CONFIG_OPENVSWITCH CONFIG_SIXPACK, SMEP/SMAP off CONFIG_XFRM_ESP,FUSE for PF CONFIG_NET_SCHED CONFIG_NF_TABLES

0.00049 0.00045 0.00029

Race→UAF UAF Race→UAF→ArbWrite

× × ✓

CAP_NET_ADMIN CONFIG_KSMBD_SERVER CONFIG_IPV6_MROUTE, 2+ CPUs

RQ3 (Overall Effectiveness): How does P RIM S YNTH compare with baseline tools in end-to-end multi-primitive reproduction? RQ4 (Efficiency and LLM Performance): What is the runtime efficiency of the multi-agent framework based on different tools and LLMs? Experimental Setup. As Table II lists, to evaluate the performance of P RIM S YNTH, we build a benchmark of 16 Linux kernel vulnerabilities with assigned CVE IDs across 5 vulnerability types: Out-of-Bounds (OOB), Use-After-Free (UAF), Double-free (DF), Race Condition (Race), and Integer Overflow (IntOverflow). To evaluate P RIM S YNTH with a constrained information condition, 25% of the vulnerabilities have no public exploitation description or executable PoC (marked as × in Table II). Since no existing baseline covers the full PrimSynth workflow, we compare against prior work at the closest comparable subtask granularity. A. RQ1: Primitive Extraction Accuracy 1) Metrics and Setup: We evaluate primitive extraction with two metrics: PMR (Primitive Match Rate): the percentage of cases whose extracted primitive with candidate object type matches ground truth and whose grounded capabilities are validated by signals (e.g., UAF/OOB cases require corruption semantics and reachable paths via S1/S2). PMR =

|{cases : type match ∧ capability evidence}| |total cases|

OFLA (Object-Field Localization Accuracy): the precision of object-field localization under FromField/StructType constraints in Section 3, validated by static-dynamic alignment (S7 vs S1). OF LA = 1 −

|S7.of f set − S1.of f set| sizeof (struct)

1 EPSS scores are obtained from the FIRST.org Exploit Prediction Scoring System (EPSS) API https://api.first.org/data/v1/epss) on 2026-06-10.

The PMR and OFLA pair together measure whether extracted primitives are both semantically correct and operationally grounded: PMR addresses class-level correctness, while OFLA validates object-field grounding required by identical-object-centric reasoning (OFLA > 0.8 indicates accurate localization). 2) Results: Table III presents the primitive extraction results for all 16 CVE cases, including the complete primitive chain with stage count, PMR, identical objects identified, and average OFLA. All 16 cases achieve 100% PMR with OFLA ranging from 65% to 92%. The OFLA distribution reflects varying localization complexity: OOB vulnerabilities achieve 75–92% through explicit structure field relationships; UAF vulnerabilities achieve 78–86% through lifecycle signal correlation; Race-conditioned vulnerabilities exhibit 65–68% due to non-deterministic execution. The validation signal framework grounds primitive extraction in concrete execution evidence through S1–S9 signal chains. Notably, the framework identifies valid primitive paths for recently disclosed vulnerabilities lacking public PoC documentation. For CVE-2024-53197 (USB Audio OOB, EPSS 0.02, no public exploit), the tool combination discovers the usb_host_config to pipe_buffer exploitation chain through S7 object layout analysis, S2 trace validation, and S3 lifecycle tracking. For CVE-2024-39486 (Race-to-UAF in IPv6 MLD), SyzDirect’s directed mutation generates candidate interleavings while PODE identifies inet6_dev and ifmcaddr6 as identical objects through RCU pointer dependency analysis. Ablation study. To further validate the systematic characterization’s effectiveness in discovering candidate objects and primitive paths, we conduct an ablation study examining the contribution of SyzDirect fuzzing and PODE static analysis when combined with the Discovery agent knowledge construction. Table IV presents the candidate object recall and primitive path coverage under four tool configurations across representative CVEs spanning OOB, UAF, DoubleFree, and Race categories. The experimental results reveal complementary strengths across tool combinations. Discovery

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

8

TABLE III P RIMITIVE E XTRACTION ACCURACY: M ATCHED P RIMITIVES AND O BJECT-F IELD L OCALIZATION (OFLA) CVE ID CVE-2019-15666 (OOB→UAF→ArbWrite) CVE-2021-22600 (DF→InfoLeak→CFH) CVE-2021-42008 (OOB→InfoLeak→CFH) CVE-2022-0185 (IntOF→OOB→InfoLeak→ArbWrite) CVE-2022-0995 (OOB→InfoLeak→ArbWrite→CFH) CVE-2022-1015 (IntOF→OOB→InfoLeak→CFH) CVE-2022-1043 (UAF→InfoLeak→ArbWrite) CVE-2022-2588 (UAF→DF→ArbWrite) CVE-2022-2639 (IntOF→OOB→UAF→ArbWrite) CVE-2022-25636 (OOB→UAF→CFH) CVE-2022-27666 (OOB→InfoLeak→ArbWrite) CVE-2022-32250 (UAF→InfoLeak→ArbWrite) CVE-2024-39486 (Race→UAF→ArbWrite) CVE-2024-53197 (OOB) CVE-2025-38477 (Race→UAF) CVE-2026-23427 (UAF→ArbWrite→CFH) Total

Steps 3 4 3 4 4 4 3 3 5 3 3 3 3 1 2 3

PMR ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ 100%

Identical Objects in Matched Primitives xfrm policy, xfrm state packet ring buffer→signalfd ctx→passwd sixpack→userfaultfd→modprobe path legacy fs ctx→msg msg→pipe buffer watch queue→msg msg→pipe buffer →modprobe path nft expr→msg msg→modprobe path io uring→cred→suid route4 filter→file→cred sw flow actions→msg msg→pipe buffer flow rule→msg msg→ethtool ops/pipe buffer skcipher walk→user key payload→msg msg nft set elem→user key payload→io uring →modprobe path inet6 dev→ifmcaddr6→modprobe path usb host config qfq aggregate ksmbd tree conn→ksmbd file→modprobe path Avg OFLA (w/ offset data): 0.81

Avg OFLA 0.83 0.86 0.88 0.82 0.92 0.86 0.84 0.86 0.81 0.83 0.80 0.78 0.68 0.75 0.65 0.79

TABLE IV T OOL C OMBINATION A NALYSIS : C ANDIDATE O BJECT D ISCOVERY AND P RIMITIVE PATH E XPLORATION CVE ID CVE-2022-0995 (OOB) CVE-2022-2588 (UAF) CVE-2022-1043 (UAF) CVE-2024-53197 (OOB) CVE-2024-39486 (Race) CVE-2026-23427 (UAF) Avg Recall Avg Iterations

Discovery 12/28 (43%) 8/15 (53%) 6/12 (50%) 4/9 (44%) 3/8 (38%) 5/11 (45%) 45% 18.5

+SyzDirect 22/28 (79%) 11/15 (73%) 9/12 (75%) 6/9 (67%) 5/8 (63%) 7/11 (64%) 70% 12.3

Agent alone, relying on knowledge base retrieval and patch analysis, achieves only 45% candidate recall with high iteration counts (18.5 average) due to candidate space explosion without runtime validation guidance. Adding SyzDirect directed fuzzing improves recall to 70% by generating concrete execution traces that validate reachable syscall sequences. The full combination achieves 96% average recall with only 4.2 iterations, demonstrating synergistic effects where Discovery provides initial hypotheses, SyzDirect validates execution feasibility, and PODE refines object field layouts. Answer to RQ1: Systematic characterization achieves reliable primitive extraction by integrating knowledge construction, directed execution, and static analysis. This combination reduces candidate object space by 98.5% (from 340 to 5.2 average candidates) while maintaining 100% primitive match rate, enabling discovery of alternative exploitation paths beyond documented PoC techniques with OFLA ranging 0.65– 0.92 across vulnerability classes. B. RQ2: Synthesis Utility 1) Metrics and Setup: We design three metrics for primitive synthesis evaluation: SSR (Strategy Synthesis Rate): step-wise synthesis rate measuring code generation fidelity, quantifying how completely the synthesized code implements the extracted primitive path’s step transitions according to strategy representation. SSR =

1 X |{ψ ∈ Ψi | code gen(ψ) = SAT}| , |B| |Ψi | Ψi ∈B

time where Ψi = {Ψobj , Ψenv , Ψsig i i , Ψi i } is the constraint set for transition pi → pi+1 , and code gen(ψ) denotes whether

+PODE 18/28 (64%) 14/15 (93%) 10/12 (83%) 8/9 (89%) 6/8 (75%) 9/11 (82%) 81% 8.7

Full Combo 27/28 (96%) 15/15 (100%) 12/12 (100%) 9/9 (100%) 7/8 (88%) 10/11 (91%) 96% 4.2

Ground Truth 28 objects 15 objects 12 objects 9 objects 8 objects 11 objects – –

constraint ψ is successfully encoded into executable code (validated by S7/S1 for object, S3 for temporal, S2/S4 for environment, and S5/S6 for signals). Different from PMR’s object-oriented extraction correctness, SSR captures synthesis completeness through per-constraint fulfillment ratios, enabling fine-grained measurement of strategy-to-code fidelity. SYR (Syntax Correctness Rate): compilation pass ratio across all synthesis iterations. SMR (Semantic Correctness Rate): semantic completion ratio, indicating synthesized code is compiled and then validated with signals or failed with inductive feedback. To evaluate how synthesis utility varies with information availability, we design four constraint conditions for each CVE: L4-Complete provides full PoC code with step-wise strategy, validation oracles, and mitigation documentation; L3Partial-PoC removes ROP chain details and final-stage validation oracles; L2-Partial-Patch retains only patch analysis and primitive chain inference; L1-Minimal provides only CVE metadata (type, component). This setup reveals which missing information causes synthesis failure, what strategy instance is required, and which tools compensate for information gaps. 2) Results: As Table V shows, initial constrained information propagates through the agent flow, causing cascading failures at the above three evaluation metrics. The L4-Complete condition achieves 70–88% SSR for standard OOB/UAF cases, while race-conditioned cases show lower baseline performance (CVE-2024-39486: 45% SSR; CVE-2025-38477: 42% SSR) due to inherent timing instability. The L3-Partial-PoC constraint reveals distinct failure modes: ROP-dependent chains (CVE-2022-0995, CVE-2022-1015) stall at AW/CFH stages with 20–30% SMR reduction, while timing-dependent chains (CVE-2021-42008, CVE-2022-2588) suffer S3 lifecycle ora-

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

9

TABLE V S YNTHESIS U TILITY U NDER C ONSTRAINED I NFORMATION L EVEL CVE ID CVE-2022-0995 (OOB→InfoLeak →ArbWrite →CFH)

Info. Level Missing Instance L4-Complete None L3 (no ROP) ROP gadget addresses L2 (patch only) Strategy granularity, obj hints L1 (metadata) All operational details L4-Complete None CVE-2021-42008 L3 (no timing) userfaultfd timing control (OOB→InfoLeak L2 (patch only) Object field offsets →CFH) L1 (metadata) rx count cooked semantics L4-Complete None CVE-2022-32250 L3 (no set expr) NFT SET EXPR state machine (UAF→InfoLeak L2 (patch only) Element lifecycle sequences →ArbWrite) L1 (metadata) nf tables internals L4-Complete None CVE-2021-22600 L3 (no cred) cred reallocation timing (DF→InfoLeak L2 (patch only) Handle=0 trigger condition →CFH) L1 (metadata) cls route internal L4-Complete None CVE-2022-2588 L3 (no kcmp) kcmp overlap detection (UAF→DF L2 (patch only) Cross-cache spraying seq. →ArbWrite) L1 (metadata) tc filter internals L4-Complete None CVE-2022-1043 L3 (no wrap) ID wraparound mechanism (UAF→InfoLeak L2 (patch only) Personality allocation path →ArbWrite) L1 (metadata) io uring internals L4-Complete None CVE-2022-27666 L3 (no fuse) FUSE page fault handler (OOB→InfoLeak L2 (patch only) 8-page allocation pattern →ArbWrite) L1 (metadata) ESP6 packet processing L4-Complete None CVE-2022-0185 L3 (no pipe) DirtyPipe splice ops (IntOF→OOB L2 (patch only) Size wraparound calc. →InfoLeak L1 (metadata) fs context internals →ArbWrite) L4-Complete None CVE-2019-15666 L3 (no rehash) Policy rehash timing (OOB→UAF L2 (patch only) Index/dir mismatch cond. →ArbWrite) L1 (metadata) xfrm migrate internals L4-Complete None CVE-2022-25636 L3 (no offload) Offload handling path (OOB→UAF L2 (patch only) nf tables flow rule layout →CFH) L1 (metadata) nf tables offload internals L4-Complete None CVE-2022-1015 L3 (no chain) ROP chain construction (IntOF→OOB L2 (patch only) Base*4 overflow calc. →InfoLeak L1 (metadata) nft tables expr internals →CFH) L4-Complete None CVE-2024L3 (no gadget) USB gadget framework 53197 L2 (patch only) bNumConfigurations trust (OOB) L1 (metadata) USB audio internals L4-Complete None CVE-2024L3 (no race) Race window calibration 39486 L2 (patch only) IPv6 MLD teardown seq. (Race→UAF) L1 (metadata) inet6 dev internals L4-Complete None CVE-2026L3 (no ksmbd) SMB server context 23427 L2 (patch only) Tree connection lifecycle (UAF) L1 (metadata) ksmbd internals L4-Complete None CVE-2022L3 (no ovs) Open vSwitch datapath 2639 L2 (patch only) Flow action allocation (IntOF) L1 (metadata) Open vSwitch internals L4-Complete None CVE-2025L3 (no qfq) QFQ scheduler internals 38477 L2 (patch only) Aggregate detach timing (Race→UAF) L1 (metadata) qfq scheduler internals Total SSR (16 CVEs with originally highest L) Avg: Total SSR (16 CVEs with inferred info till L4) Avg:

SSR 88% 72% 58% 32% 78% 65% 52% 28% 82% 68% 48% 25% 70% 58% 45% 22% 75% 62% 42% 20% 82% 68% 48% 25% 72% 58% 45% 22% 76% 62% 48% 25% 74% 60% 46% 24% 78% 62% 48% 25% 75% 58% 48% 24% 68% 52% 42% 22% 45% 35% 28% 18% 52% 42% 32% 18% 48% 38% 28% 15% 42% 32% 22% 12% 67.0% 69.1%

cle instability, degrading SMR to 52–58%. The L1-Minimal condition shows 12–32% SSR across all cases, confirming that metadata-only synthesis yields only component identification. We also summarize the synthesis patterns in Section VII. Detailed case studies by vulnerability type are provided in Appendix A. Influence of PoC availability. To characterize the impact of PoC availability, Table VI compares synthesis performance

SYR 94% 88% 72% 45% 91% 85% 68% 38% 89% 82% 65% 35% 88% 82% 65% 35% 86% 80% 62% 32% 90% 85% 68% 38% 85% 78% 62% 35% 88% 82% 68% 38% 87% 80% 65% 36% 88% 82% 68% 38% 87% 80% 68% 36% 82% 72% 58% 32% 68% 55% 42% 28% 72% 62% 48% 28% 68% 58% 45% 25% 62% 52% 38% 22% – –

SMR 85% 65% 45% 22% 76% 58% 42% 18% 78% 62% 38% 15% 72% 55% 38% 15% 70% 52% 35% 12% 78% 62% 42% 18% 68% 48% 38% 15% 74% 55% 42% 18% 72% 55% 40% 16% 75% 58% 42% 18% 72% 52% 42% 16% 62% 45% 35% 15% 38% 28% 18% 12% 48% 38% 28% 12% 42% 32% 22% 10% 35% 25% 18% 8% – –

Required Signals/Tools Outcome S2+S4+S5+S6 / Full toolchain Full chain: msg msg+pipe buffer S5+S7 / PODE S8-S9 InfoLeak→AW partial S1+S2+S3 / SyzDirect+dbg-tool OOB trigger only S1 only / Static analysis Type inferred (OOB) S2+S3+S5+S6 / Full toolchain Full chain: sixpack rx+userfaultfd S3 (lifecycle) / dbg-tool Race window unstable S7+S8 / PODE static analysis OOB trigger partial S1 only / SyzDirect fuzzing Component identified S2+S3+S5+S6 / Full toolchain Full chain: keyring+io uring +mqueue S3+S4+S7 / PODE+dbg-tool UAF trigger partial S1+S2+S3 / SyzDirect+dbg-tool Primitive inferred S1 partial / Static analysis Type guess (unstable) S2+S3+S5+S6 / Full toolchain Full chain: route4 filter double-free S3+S4 / dbg-tool+kcmp DF→Info partial S1+S2 / SyzDirect UAF trigger only S1 partial / Static analysis Component identified S2+S3+S5+S6 / Full toolchain Full chain: DirtyCred file overlap S3+S5 / dbg-tool DF→AW partial S1+S2+S3 / SyzDirect UAF trigger only S1 only / Static analysis Type guess (unstable) S2+S3+S5+S6 / Full toolchain Full chain: ID wraparound cred hijack S3+S4 / dbg-tool AW trigger partial S1+S2+S3 / SyzDirect+dbg-tool UAF trigger only S1 partial / Static analysis Type inferred (UAF) S2+S4+S5+S6 / Full toolchain Full chain: ESP6 skcipher OOB S3+S5 / dbg-tool+FUSE InfoLeak partial S1+S2 / SyzDirect OOB trigger only S1 only / Static analysis Component identified S2+S4+S5+S6 / Full toolchain Full chain: fsconfig+DirtyPipe S5+S6 / dbg-tool OOB→Info partial S1+S2 / SyzDirect+dbg-tool IntOF trigger only S1 only / Static analysis Type inferred (IntOF) S2+S3+S5+S6 / Full toolchain Full chain: xfrm policy rehash S3+S4 / dbg-tool OOB→UAF partial S1+S2 / SyzDirect OOB trigger only S1 only / Static analysis Type guess (unstable) S2+S3+S5+S6 / Full toolchain Full chain: flow rule offload S3+S4 / dbg-tool OOB→UAF partial S1+S2 / SyzDirect OOB trigger only S1 only / Static analysis Component identified S2+S3+S5+S6 / Full toolchain Full chain: nft payload overflow S5+S7+S8 / PODE S8-S9 Info→CFH partial S1+S2 / SyzDirect+dbg-tool IntOF trigger only S1 only / Static analysis Type inferred (IntOF) S2+S4+S5 / Full toolchain OOB trigger: usb host config S2+S3 / dbg-tool+USB stack OOB partial (no exploit) S1+S2 / Static analysis OOB pattern inferred S1 partial / Static analysis Component identified S2+S3+S4 / Full toolchain Race trigger: MLD join/leave S3+S4 / dbg-tool+timing UAF trigger unstable S1+S3 / SyzDirect+dbg-tool Race inferred (weak) S3 partial / Static analysis Type guess (Race→UAF) S2+S3+S5 / Full toolchain UAF trigger: ksmbd tree conn S2+S3 / dbg-tool+SMB stack UAF partial (no chain) S1+S2 / SyzDirect+dbg-tool UAF trigger only S1 partial / Static analysis Component identified S2+S3+S5 / Full toolchain UAF trigger: sw flow actions S2+S3 / dbg-tool+OVS stack UAF partial (no chain) S1+S2 / SyzDirect+dbg-tool UAF trigger only S1 partial / Static analysis Type guess (unstable) S2+S3+S4 / Full toolchain Race trigger: qfq aggregate S3+S4 / dbg-tool+sched UAF trigger unstable S1+S3 / SyzDirect+dbg-tool Race inferred (weak) S3 partial / Static analysis Type guess (unstable) L4 for 14 CVEs; L3 for CVE-2024-53197; L2 for CVE-2024-39486

between 12 CVEs with publicly documented PoC and 4 CVEs lacking a stable public PoC. Vulnerabilities with public PoC achieve 82.4% SSR and 77.1% SMR with averagely 4.8 iterations, while the no-PoC cohort shows 61.3% SSR and 52.8% SMR requiring 9.6 iterations on average, representing a 21.1% SSR degradation and 100% iteration increase. The end-to-end success rate drops from 72% to 38% without PoC guidance. The tool-grounded compensation mechanisms

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

10

TABLE VI S YNTHESIS P ERFORMANCE : P O C AVAILABLE VS . N O P O C

as Pub. on Table VIII); SSR compares with KOOBE’s strategy synthesis scope. KOOBE remains limited to OOB-type vulnerabilities with static templates, while AlphaExp focuses on object identification without primitive chaining. We select 6 CVEs at the intersection of our dataset and KOOBE/AlphaExp evaluation sets, covering OOB (4 cases), Double-Free (1 case), and IntOverflow→OOB (1 case). As Table VIII shows, the framework handles complex multi-step exploitation chains. P RIM S YNTH achieves 70– 75% SSR on cases where both baselines fail (Double-Free, IntOverflow→OOB), indicating that extended strategy representation and agentic validation extend coverage to previously unsupported primitive classes. 2) Ablation Study: Agent Collaboration: We conduct an ablation study on 5 representative CVEs with four configurations: (1) Full Collaboration (complete 3-agent loop), (2) DiscoverySynthesis only (Validation Agent disabled), (3) ValidationSynthesis only (Discovery Agent disabled), and (4) Synthesisonly (no upstream feedback). The ablation results in Table IX demonstrate that multiagent collaboration is essential: Full Collaboration achieves 45%–88% SSR with 3–9 iterations, while Synthesis-Only degrades to 15%–42% SSR requiring 12–23 iterations. This 2.1× SSR improvement confirms the necessity of validationgrounded feedback in the synthesis loop. Answer to RQ3: P RIM S YNTH achieves 77.13% average SSR versus baseline tools limited to specific vulnerability classes (KOOBE to OOB types, AlphaExp to object identification without chaining), handling complex steps where baselines fail completely. Multi-agent collaboration drives 2.1× improvement over Synthesis-Only through validationgrounded feedback (17%–24% SSR lift), Discovery Agent refinement (2%–7% lift), signal-driven efficiency (63–75% iteration reduction), and heterogeneous LLM selection (8%– 15% SSR gain), achieving end-to-end effectiveness with an average time of 72.4s across vulnerability classes previously unsupported by automated approaches.

PoC Status PoC Available No PoC Difference

CVE Count 12 4 –

SSR (%) 82.4 61.3 -21.1%

SMR (%) 77.1 52.8 -25.4%

Avg Iterations 4.8 9.6 +100%

End-toEnd 7.2/10 3.8/10 -47%

enabling no-PoC performance operate through differentiated tool dependencies: SyzDirect achieves 84% candidate recall through directed mutation when object identity hints are absent (vs. 34% for static analysis alone); PODE S7 achieves 81% field localization accuracy under L2 constraints; and dbg-tool S3 lifecycle tracking achieves 35–55% race reproducibility through statistical iteration. Further details on compensation patterns are in Appendix A. Critical strategy instances. Table VII summarizes the critical strategy instances identified through this controlled experiment, mapping specific strategy failures to required compensation mechanisms. The observed failures are not uniformly distributed: object identity hints and primitive upgrade paths dominate transition-level breakdowns, while timing control and strategy step sequence primarily destabilize race-conditioned cases. This mapping clarifies why compensation must be signal-coupled rather than generic—S2/S3backed candidate narrowing mitigates search-space explosion, S4/S5/S6-backed loop validation prevents invalid step propagation, and PODE-assisted S7–S9 inference recovers missing structural constraints when PoC details are unavailable. Answer to RQ2: P RIM S YNTH successfully synthesizes multi-primitive exploitation chains with 82.4% SSR when public PoC is available and 61.3% SSR without the guidance of primitive hypotheses, demonstrating tool-driven compensation through SyzDirect candidate discovery (84% recall), PODE layout inference (81% OFLA), and dbg-tool temporal tracking (35–55% race reproducibility). The 21.1% performance gap quantifies PoC value while confirming automated synthesis capability for 0-day-equivalent scenarios through multi-agent validation-grounded feedback. Across all 16 CVEs, the original highest-available information setting yields an average SSR of 67.0%, combining 14 L4-complete cases with two originally incomplete cases (CVE-2024-53197 at L3 and CVE2024-39486 at L2). When these two low-information cases are elevated to inferred L4 via strategy-level reasoning and tool-grounded compensation, average SSR increases to 69.1% (+2.1 SSR point on average). C. RQ3: Overall Effectiveness 1) Baseline Comparison: We measure end-to-end effectiveness as the percentage of CVEs achieving complete multiprimitive reproduction from vulnerability trigger to privilege escalation, comparing P RIM S YNTH against KOOBE [21] (symbolic analysis-based OOB capability extraction) and AlphaExp [8] (expert system for security-sensitive object identification). We align metrics with baseline capabilities: PMR compares with AlphaExp’s object identification rate, based on the number of objects from publicly available PoCs (notated

D. RQ4: Efficiency and LLM Performance 1) Tool Response Time: Table X presents the average response times for MCP tools integrated in P RIM S YNTH. SyzDirect (24,500ms on average) is the highest-latency tool due to fuzzing-based operation, but its contribution to validation signal acquisition (S1, S2) is critical. Static tools (PODE, GCC) provide sub-150ms responses, while dynamic tools range 890ms–3,200ms, depending on kernel boot overhead. 2) Multi-Agent System Performance: Table XI shows the average execution times for complete exploitation primitive chain synthesis. The total pipeline completes in 72.4s on average with 28–62 tool calls. Validation dominates execution time (45.4s, 63%) due to kernel boot and dynamic signal acquisition, while Discovery (9.8s) and Synthesis (17.2s) are comparatively lightweight. 3) Effect of LLM Selection: The “Best Performance LLM” column in Table IX reveals performance specialization across five evaluated models. GPT-5.3 achieves the highest overall SSR (88%) in Full Collaboration configurations, excelling in

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

11

TABLE VII C RITICAL S TRATEGY I NSTANCE FOR S YNTHESIS S UCCESS Strategy Instance ROP gadget addresses Object field offsets Timing control Strategy step sequence Object identity hints Primitive upgrade paths

Failure AW/CFH step failure OOB target misalignment Race window instability Wrong operation ordering Candidate space explosion Chain termination

SSR Drop 16-24% 20-26% 13-20% 18-22% 30-35% 22-28%

TABLE VIII OVERALL E FFECTIVENESS C OMPARISON WITH BASELINES CVE ID

Type

CVE-2021-22555

OOB

CVE-2022-0995 CVE-2022-27666 CVE-2021-22600 CVE-2022-25636 CVE-2022-1015

Step Num. 5

OOB 5 OOB 5 DF 4 OOB 3 IntOF 4 →OOB Average (baseline comparison)

KOOBE (Gen./Val.) unk/0 (S2E failed) unk/0 unk/0 × × ×

AlphaExp (Id./Pub.) 4/3

PMR SSR (%) (%) 100 78

6/2 3/2 × 6/2 ×

100 100 100 100 100

88 72 70 78 75

100

77

strategic Synthesis through enhanced reasoning over complex primitive hypothesis. GPT-4 demonstrates strong performance in Discovery (information retrieval and knowledge construction) with robust structured representation handling. Opus4.6 maintains superior code generation fidelity in pure Synthesis scenarios, particularly for intricate heap manipulation sequences. Qwen3 achieves highest Validation accuracy (72– 88% for race-conditioned cases) through robust signal interpretation from dynamic execution traces. GLM-4.7 shows competitive performance in both Validation (nf tables cases) and Synthesis (fallback scenarios), with balanced reasoning and generation capabilities. This diverse evaluation confirms that optimal LLM selection should be agent-specific rather than framework-uniform, with different models excelling in distinct stages. Answer to RQ4: P RIM S YNTH completes end-to-end primitive synthesis in 72.4s on average, with Validation dominating at 63% of total time due to dynamic signal acquisition. LLM performance is stage-dependent: GPT-5.3 excels in Synthesis (88% SSR), Qwen3 in Validation (72–88% accuracy for race cases), and GPT-4 in Discovery. This heterogeneous LLM selection contributes 8–15% SSR gain over uniform model deployment, confirming that agent-specific model assignment is essential for optimal framework performance. VII. D ISCUSSION In P RIM S YNTH, the systematic characterization, combined with multi-agent tool integration, enables reliable primitive extraction and synthesis across vulnerability classes that prior approaches could not address. The framework’s core contribution lies not in eliminating the need for human expertise in kernel exploitation, but in making exploitation reasoning systematic, comparable, and reproducible, thereby enabling security teams to allocate limited resources based on testable primitive assessments rather than ad hoc manual analysis. Public-PoC-absent support. The demonstrated capability to identify valid exploitation paths for recently disclosed

Compensation PODE S8-S9 pointer analysis S7 layout + S3 lifecycle Statistical iteration (8-16x) S4 boundary + S3 lifecycle S2 trace + S3 tracking S5-S6 validation

Tool Dependency PODE+manual resolution PODE+dbg-tool Timing handling code template Full validation loop SyzDirect+dbg-tool Template fallback

vulnerabilities without public PoC documentation, achieving 61.3% SSR in information-scarce scenarios where baselines fail entirely, represents progress toward automated exploitability assessment suitable for defensive security applications. The performance difference between PoC-available and nopublic-PoC scenarios highlights a fundamental challenge in autonomous exploitation research: the reliance on statistical exploration when reference guidance is absent introduces both computational overhead and completeness limitations. Synthesis Patterns The experimental data reveals three distinct information-critical synthesis patterns that transcend individual CVE characteristics: (1) Object Identity Hints involves object identity hints as the dominant failure point when unavailable, causing 30-35% SSR degradation across all categories because the Synthesis Agent must explore exponentially larger candidate spaces without guidance on which kernel structures to target for corruption; this pattern is most pronounced in CVE-2022-0995 where msg_msg structure targeting requires specific adjacency to watch_queue overflow, and in CVE-2022-32250 where keyring/io_uring/mqueue object selection for UAF exploitation depends on precise kmalloc cache size matching. (2) Strategy Step Sequences involves strategy step sequences as the secondary failure point, with 18-22% SSR degradation when operation ordering must be inferred rather than referenced; this affects CVE-2021-22600 (route4_filter creation must precede handle=0 replacement), CVE-2022-1043 (IORING_REGISTER_PERSONALITY must wrap before credential reallocation), and all race-conditioned cases where teardown sequences must interleave with target operations. (3) Timing Control-like Helper Function involves timing control as the tertiary failure point, with 13-20% SSR degradation affecting race-conditioned and cross-cache cases where statistical iteration compensation increases attempt counts by 8-16x; CVE2021-42008 exemplifies this pattern where rx_count_cooked threshold detection requires userfaultfd page fault timing, and CVE-2022-2588 where DirtyCred file overlap exploitation depends on kcmp-based double-free detection timing. Implications. Our research has three practical implications for defender-oriented kernel security workflows. First, early systematic exploitability assessment is now feasible: primitive-level evidence enables patch prioritization beyond CVSS/EPSS/KEV labels, while systematic characterization supports assessment across vulnerability types. Second, validating composed primitive hypotheses moves risk assessment closer to real attack feasibility, addressing accumulated reproduction by bridging conceptual strategies and concrete operations. Third, validation-grounded multi-agent collabora-

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

12

TABLE IX A BLATION S TUDY – AGENT C OLLABORATION U NDER I SOLATED C ONTEXT CVE ID CVE-2022-0995

CVE-2021-42008

CVE-2022-32250

CVE-2024-39486

CVE-2021-22600

Configuration Full Collaboration Discovery+Synthesis Only Validation+Synthesis Only Synthesis-Only Full Collaboration Discovery+Synthesis Only Validation+Synthesis Only Synthesis-Only Full Collaboration Discovery+Synthesis Only Validation+Synthesis Only Synthesis-Only Full Collaboration Discovery+Synthesis Only Validation+Synthesis Only Synthesis-Only Full Collaboration Discovery+Synthesis Only Validation+Synthesis Only Synthesis-Only

PMR (%) 100 100 95 75 100 100 90 70 100 95 85 60 100 90 80 55 100 95 90 65

TABLE X T OOL R ESPONSE T IME P ERFORMANCE Tool GCC SyzDirect Dbg-tool PODE

Check Type syntax S1, S2 S3, S4, S5, S6 S7, S8, S9

Avg. Time 3s 24s 13s 45s

Description Static type checking Directed fuzzing engine Interactive debugging LLVM IR dependency analysis

TABLE XI AGENT C OLLABORATION P ERFORMANCE Stage Discovery Validation Synthesis Total

Avg. Time 9.8s 45.4s 17.2s 72.4s

Tool Calls 8-15 15-35 5-12 28-62

Best LLM GPT-4 / GPT-5.3 Qwen3 / GLM-4.7 Opus-4.6 / GPT-5.3 -

tion enables a methodological shift toward combining static recovery, execution evidence, and iterative feedback. Taken together, these results position P RIM S YNTH as a decisionsupport framework for evidence-backed exploitability reasoning without replacing expert judgment under full mitigation constraints. Threat to Validity. The evaluation scope also exposes important coverage boundaries in modern kernel exploitation landscapes. All experiments assume disabled or permissive SMEP/SMAP configurations, and while OOB-InfoLeakArbWrite chains theoretically enable KASLR bypass, full mitigation scenarios involving KPTI, CFI, or pointer authentication require additional primitive stages that remain outside current validation scope. The experimental reliance on ground truth derived from reference PoCs introduces validity constraints that merit consideration in interpreting results. The PMR and OFLA metrics assume correct labeling of primitive types and identical objects based on publicly documented exploitation techniques, yet these labels may reflect specific documented strategies rather than exhaustive exploitation possibilities. VIII. R ELATED W ORKS Kernel Vulnerability Reproduction and Assessment. Assessing kernel bug exploitability bridges bug discovery and ex-

SSR (%) 88 65 82 42 78 58 71 38 72 48 65 32 45 28 38 15 70 52 68 28

End-to-End ✓(8/10) ∼(4/10) ✓(7/10) ×(1/10) ✓(7/10) ∼(3/10) ∼(5/10) ×(0/10) ✓(6/10) ∼(2/10) ∼(4/10) ×(0/10) ∼(3/10) ×(0/10) ∼(1/10) ×(0/10) ✓(5/10) ∼(3/10) ∼(4/10) ×(0/10)

Iterations 3.2 6.8 4.1 12.5 3.8 7.2 5.3 15.2 4.5 9.6 6.2 18.3 8.3 14.2 11.5 22.7 5.2 8.8 6.5 16.4

Best Performance LLM GPT-5.3 (Synthesis) GPT-4 (Discovery) Opus-4.6 (Synthesis) Opus-4.6 (Synthesis) GPT-5.3 (Synthesis) GPT-4 (Discovery) Opus-4.6 (Synthesis) GLM-4.7 (Synthesis) Qwen3 (Validation) GPT-5.3 (Discovery) GLM-4.7 (Validation) Opus-4.6 (Synthesis) Qwen3 (Validation) GPT-4 (Discovery) Qwen3 (Validation) GLM-4.7 (Synthesis) GPT-5.3 (Synthesis) GPT-5.3 (Discovery) GLM-4.7 (Validation) Opus-4.6 (Synthesis)

ploit development. GREBE [22] unveiled exploitation potential through capability analysis, SyzBridge [23] bridged upstreamdownstream configuration gaps for ecosystem-wide assessment, and AEM [24] facilitated cross-version exploitability assessment. On the reproduction side, Mu et al. [1] analyzed duplicated kernel bug reports, Li et al. [3] facilitated reproduction via reverse fuzzing, and Pu et al. [25] studied agentic LLM systems for kernel N-day reproduction. These works assess whether a bug is exploitable but do not produce working exploits as P RIM S YNTH does. Automated Kernel Exploit Generation. Automated exploit generation (AEG) for the Linux kernel has attracted significant attention. FUZE [26] pioneered facilitated exploit generation for Use-After-Free vulnerabilities via kernel fuzzing. KEPLER [19] facilitated the evaluation of control-flow hijacking primitives, automatically identifying exploitable paths to function pointer hijacking. KOOBE [21] used symbolic analysis to evaluate the capability of Out-of-Bounds write vulnerabilities. BridgeRouter [17] proposed automated capability upgrading of OOB write vulnerabilities to arbitrary memory write primitives via bridge and router kernel objects. Evocatio [27] conjured bug capabilities from a single PoC using directed fuzzing. These works typically focus on a single vulnerability class or a specific exploitation phase. In contrast, PrimSynth addresses the full exploitation lifecycle—from primitive discovery and validation through synthesis and chaining—across multiple vulnerability classes via multi-agent collaboration. LLM-Driven Vulnerability Analysis and Exploit Generation. LLMs have opened new frontiers in automated security analysis. Fang et al. [28] demonstrated that LLM agents can autonomously exploit one-day vulnerabilities given CVE descriptions. Wu et al. [2] explored LLMs for large-scale kernel bug discovery. The multi-agent paradigm has also been applied to security tasks, such as automated network attack execution [29] and complex code generation [30]. Despite these advances, existing LLM-based approaches lack structured knowledge of kernel-specific exploitation primitives, cannot perform low-level heap state reasoning, and do not integrate dynamic validation in realistic kernel environments.

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

PrimSynth addresses these gaps by combining formal notations with a multi-agent architecture that integrates static analysis, directed fuzzing, and LLM-based reasoning. IX. C ONCLUSION We have presented P RIM S YNTH, a multi-agent framework for automated discovery, validation, and synthesis of Linux kernel exploit primitives. Our work addresses three fundamental challenges in automated kernel exploitation: systematic primitive classification and modeling, accurate and reliable primitive extraction, and automated synthesis of primitive hypotheses into working exploits. Through systematic evaluation on 16 real-world CVEs, we demonstrate that the framework achieves high accuracy in primitive identification, effective synthesis of multi-step exploitation, and broad coverage across vulnerability types previously unsupported by baseline tools. Our experiments further indicate that exploit development bottlenecks increasingly lie in reliable primitive composition and environment-specific grounding rather than in initial bug triggering alone, confirming the cumulative nature of reproduction challenges. R EFERENCES [1] D. Mu, Y. Wu, Y. Chen, Z. Lin, C. Yu, X. Xing, and G. Wang, “An In-depth Analysis of Duplicated Linux Kernel Bug Reports,” in Proceedings 2022 Network and Distributed System Security Symposium. San Diego, CA: Internet Society, Feb. 2022. [2] Q. Wu, Y. Xiao, D. Kirat, K. Eykholt, J. Jang, and D. Schales, “One Bug, Hundreds Behind: LLMs for Large-Scale Bug Discovery,” in Proceedings of the 43rd International Conference on Machine Learning (ICML). Seoul, South Korea: PMLR, Jul. 2026. [Online]. Available: https://icml.cc/virtual/2026/poster/61586 [3] X. Li, Y. Kang, C. Wu, D. Liu, J. Wang, Y. Sun, Z. Wu, Y. Wang, R. Ma, and Q. Wei, “Yesterday Once MorE: Facilitating Linux Kernel Bug Reproduction via Reverse Fuzzing,” IEEE Transactions on Information Forensics and Security, vol. 20, pp. 5224–5239, 2025. [4] “Prompt2own: Real-world kernel exploit development with llms,” 2026, briefings schedule page, accessed 2026-08-26. [Online]. Available: https://blackhat.com/us-26/briefings/schedule/index.html# prompt2own-real-world-kernel-exploit-development-with-llms-52528 [5] R. Branco, K. Hu, H. Kawakami, and K. Sun, “A Mathematical Modeling of Exploitations and Mitigation Techniques Using Set Theory,” in 2018 IEEE Security and Privacy Workshops (SPW), San Francisco, CA, USA, 2018, pp. 323–328. [6] B. Azad, “A survey of recent iOS kernel exploits,” Google Project Zero Blog, 2020. [Online]. Available: https://googleprojectzero.blogspot.com/ 2020/06/a-survey-of-recent-ios-kernel-exploits.html [7] Y. Chen, Z. Lin, and X. Xing, “A Systematic Study of Elastic Objects in Kernel Exploitation,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (CCS). Virtual Event, USA: ACM, Nov. 2020, pp. 1165–1184. [8] R. Wang, K. Chen, C. Zhang, Z. Pan, Q. Li, S. Qin, S. Xu, M. Zhang, and Y. Li, “AlphaEXP: An Expert System for Identifying Security-Sensitive Kernel Objects,” in 32nd USENIX Security Symposium (USENIX Security 23). Anaheim, CA: USENIX Association, Aug. 2023, pp. 4229– 4246. [9] E. Avllazagaj, Y. Kwon, and T. Dumitras, “SCAVY: Automated Discovery of Memory Corruption Targets in Linux Kernel for Privilege Escalation,” in 33rd USENIX Security Symposium (USENIX Security 24). Philadelphia, PA: USENIX Association, Aug. 2024, pp. 7141– 7158. [10] D. Liu, P. Wang, X. Zhou, W. Xie, G. Zhang, Z. Luo, T. Yue, and B. Wang, “From Release to Rebirth: Exploiting Thanos Objects in Linux Kernel,” IEEE Transactions on Information Forensics and Security, vol. 18, pp. 533–548, 2023. [11] D. Liu, X. Meng, P. Wang, X. Zhou, W. Xie, and B. Wang, “Constructing Arbitrary Write via Puppet Objects and Delivering Gadgets in Linux Kernel,” Computers & Security, vol. 150, p. 104189, 2024.

13

[12] Y. Chen and X. Xing, “SLAKE: Facilitating slab manipulation for exploiting vulnerabilities in the Linux kernel,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (CCS). London, UK: ACM, Nov. 2019, pp. 1707–1722. [13] K. Zeng, Y. Chen, H. Cho, X. Xing, A. Doupé, Y. Shoshitaishvili, and T. Bao, “Playing for K(H)eaps: Understanding and improving linux kernel exploit reliability,” in 31st USENIX Security Symposium (USENIX Security 22). Boston, MA: USENIX Association, Aug. 2022, pp. 71– 88. [14] Z. Lin, Y. Wu, and X. Xing, “DirtyCred: Escalating privilege in Linux kernel,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (CCS). Los Angeles, CA: ACM, Nov. 2022, pp. 1963–1976. [15] K. Zeng, Z. Lin, K. Lu, X. Xing, R. Wang, A. Doupé, Y. Shoshitaishvili, and T. Bao, “Retspill: Igniting user-controlled data to burn away linux kernel protections,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 3093–3107. [16] L. Maar, L. Giner, D. Gruss, and S. Mangard, “When Good Kernel Defenses Go Bad: Reliable and Stable Kernel Exploits via DefenseAmplified TLB Side-Channel Leaks,” in 34th USENIX Security Symposium (USENIX Security 25). Seattle, WA: USENIX Association, Aug. 2025, pp. 7447–7465. [17] D. Xie, D. He, W. You, J. Huang, B. Liang, S. Gan, and W. Shi, “BridgeRouter: Automated Capability Upgrading of Out-Of-Bounds Write Vulnerabilities to Arbitrary Memory Write Primitives in the Linux Kernel,” in 2025 IEEE Symposium on Security and Privacy (SP). IEEE, 2025, pp. 810–828. [18] Z. Liang, X. Zou, C. Song, and Z. Qian, “K-LEAK: Towards Automating the Generation of Multi-Step Infoleak Exploits against the Linux Kernel,” in 31st Annual Network and Distributed System Security Symposium (NDSS). San Diego, CA: Internet Society, Feb. 2024. [19] W. Wu, Y. Chen, X. Xing, and W. Zou, “KEPLER: Facilitating Controlflow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities,” in 28th USENIX Security Symposium (USENIX Security 19). Santa Clara, CA: USENIX Association, Aug. 2019, pp. 1187–1204. [20] X. Tan, Y. Zhang, J. Lu, X. Xiong, Z. Liu, and M. Yang, “SyzDirect: Directed Greybox Fuzzing for Linux Kernel,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 1630–1644. [21] W. Chen, X. Zou, G. Li, and Z. Qian, “KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities,” in 29th USENIX Security Symposium (USENIX Security 20). USENIX Association, Aug. 2020, pp. 1093–1110. [22] Z. Lin, Y. Chen, Y. Wu, D. Mu, C. Yu, X. Xing, and K. Li, “Grebe: Unveiling exploitation potential for linux kernel bugs,” in 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022, pp. 2078–2095. [23] X. Zou, Y. Hao, Z. Zhang, J. Pu, W. Chen, and Z. Qian, “SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem,” in 31st Annual Network and Distributed System Security Symposium (NDSS). San Diego, CA: Internet Society, Feb. 2024. [24] Z. Jiang, Y. Zhang, J. Xu, X. Sun, Z. Liu, and M. Yang, “AEM: Facilitating Cross-Version Exploitability Assessment of Linux Kernel Vulnerabilities,” in 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 2122–2137. [25] J. Pu, X. Li, Z. Liang, J. Cox, Y. Wu, K. Shehada, A. Srivastav, and Z. Qian, “Patch-to-PoC: A Systematic Study of Agentic LLM Systems for Linux Kernel N-Day Reproduction,” arXiv:2602.07287, 2026. [26] W. Wu, Y. Chen, J. Xu, X. Xing, X. Gong, and W. Zou, “FUZE: Towards facilitating exploit generation for kernel Use-After-Free vulnerabilities,” in 27th USENIX Security Symposium (USENIX Security 18). Baltimore, MD: USENIX Association, Aug. 2018, pp. 781–797. [27] Z. Jiang, S. Gan, A. Herrera, F. Toffalini, L. Romerio, C. Tang, M. Egele, C. Zhang, and M. Payer, “Evocatio: Conjuring Bug Capabilities from a Single PoC,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. Los Angeles, CA: ACM, Nov. 2022, pp. 1599–1613. [28] R. Fang, R. Bindu, A. Gupta, and D. Kang, “LLM Agents can Autonomously Exploit One-day Vulnerabilities,” arXiv preprint arXiv:2404.08144, 2024. [29] J. Xu, J. W. Stokes, G. McDonald, X. Bai, D. Marshall, S. Wang, A. Swaminathan, and Z. Li, “AutoAttacker: A Large Language Model Guided System to Implement Automatic Cyber-attacks,” arXiv:2403.01038, 2024. [30] J. Yang, C. E. Jimenez, A. Wettig, K. Lieret, S. Yao, K. Narasimhan, and O. Press, “SWE-agent: Agent-computer interfaces enable automated software engineering,” in Proceedings of the 38th Conference on Neural

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

Information Processing Systems (NeurIPS), Vancouver, Canada, Dec. 2024.

A PPENDIX For CVE-2022-0995, SyzDirect identifies the msg_msg spraying sequence that static analysis misses, raising recall from 43% to 79%. PODE static analysis contributes structural insights: when analyzing CVE-2022-2588, PODE identifies the route4_filter to file object alias relationship through pointer flow analysis, achieving 93% recall for Double-Free cases where object lifecycle relationships dominate. The full combination achieves 96% average recall with only 4.2 iterations, demonstrating synergistic effects where Discovery provides initial hypotheses, SyzDirect validates execution feasibility, and PODE refines object field layouts. In CVE-2022-2588, while public PoCs describe DirtyCred file credential hijacking via kcmp detection, the tool combination additionally identifies a route4_filter-to-skbuff UAF chain enabling ROP-based control flow hijacking without the kcmp primitive. For CVE-2022-2639, where public documentation emphasizes cross-cache overflow to msg msg structures, PODE analysis identifies a pipe_buffer primitive path achieving arbitrary file write without the intermediate information leak stage. The Double-Free category represented by CVE-2021-22600 and CVE-2022-2588 exhibits unique information dependencies centered on object lifecycle synchronization rather than spatial memory layout. CVE-2021-22600 achieves 70% SSR under L4-Complete by leveraging the packet_ring_buffer handle=0 double-free primitive with kcmp-based file overlap detection, but L3 constraint removing cred reallocation timing details reduces SSR to 58% because the Synthesis Agent cannot determine when the freed packet_ring_buffer slot has been reoccupied by pipe_buffer object without S3 lifecycle validation. CVE-2022-2588 presents an even more severe information gradient: L4-Complete achieves 75% SSR through DirtyCred exploitation using double-freeto-file-overlap conversion, but L3 constraint removing kcmp overlap detection reduces SSR to 62% with DF→AW partial completion, and L2-Patch-Only degrades further to 42% because cross-cache spraying sequences require precise timing between basic filter defragmentation and file object spraying that cannot be inferred from patch analysis alone. The integer overflow category represented by CVE-20220185 and CVE-2022-1015 demonstrates that size calculation wraparound mechanisms are identifiable through S1-S2 signals even under L2 constraints, but the resulting OOB primitive upgrade depends critically on object identity hints: CVE-20220185 requires knowledge of msg_msg placement adjacent to the overflowed kmalloc-8 buffer for InfoLeak primitive construction, while CVE-2022-1015 depends on nft_payload structure layout for ROP chain injection, both showing 48% SSR under L2-Patch-Only with trigger-only synthesis. The UAF category shows the widest performance variation based on subsystem complexity and object lifecycle visibility. CVE-2022-1043 (io_uring personality UAF) achieves 82% SSR under L4-Complete through ID wraparound credential hijacking with clear allocation boundaries, but degrades to 68%

14

SSR under L3 because the iteration wraparound mechanism requires CPU affinity control timing that cannot be validated without S3-S4 lifecycle tracking. CVE-2022-27666 (ESP6 skcipher OOB) presents crosscache overflow characteristics where 8-page skbuff allocations overflow into adjacent slab objects, requiring FUSE page fault handling for arbitrary write completion; L4-Complete achieves 72% SSR but L3 constraint removing FUSE details reduces to 58% with InfoLeak partial completion because kernel address disclosure through OOB read succeeds while subsequent AW primitive construction stalls without user-space page fault coordination. The L1-Minimal condition reveals fundamental limitations of metadata-only synthesis: all 16 cases show 1232% SSR with component identification or type guessing as the primary outcome, with race-conditioned cases (CVE2024-39486, CVE-2025-38477) performing worst at 12-18% SSR because temporal constraints cannot be inferred from component names alone, while OOB/UAF cases with standard corruption patterns (CVE-2022-0995, CVE-2021-42008) achieve 28-32% SSR through primitive type inference based on vulnerability class heuristics. Drilling into individual cases within the no-public-PoC cohort reveals distinct compensation patterns enabled by tool integration. For CVE-2024-53197, a USB Audio OOB vulnerability disclosed in December 2024 with CISA KEV confirmation of in-the-wild exploitation but no published PoC code, the framework achieves 68% SSR under L4equivalent conditions by combining PODE S7-S8 analysis of usb_host_config structure layout with SyzDirect USB syscall mutation to identify the configuration parsing path that triggers the slab-out-of-bounds access. The Discovery Agent extracts vulnerability location marks from kernel patch analysis identifying bNumConfigurations trust issues, while the Synthesis Agent composes the discovered primitive into a targeted exploitation chain using pipe_buffer as the identical object for arbitrary write capability, achieving end-toend reproduction within 6 iterations despite the absence of reference exploit code. Similarly, for CVE-2026-23427, a ksmbd Use-After-Free vulnerability in the SMB3 server subsystem, the multi-agent framework leverages PODE static analysis to identify ksmbd_tree_conn and ksmbd_share_config as identical objects through compound request parsing logic analysis, with SyzDirect generating SMB2 syscall sequences that exercise the DURABLE_REQ_V2 replay path to trigger the UAF condition. The resulting 52% SSR and 48% SMR, while lower than PoC-guided cases, demonstrate the framework’s capability to synthesize functional exploitation primitives for zero-day-equivalent scenarios where no prior exploit intelligence exists. The performance differential between cohorts varies by vulnerability class and primitive chain complexity. For canonical OOB vulnerabilities like CVE-2024-53197, the gap is narrower (68% vs. 85% for PoC-guided OOB cases) because systematic characterization of out-of-bounds access patterns through PODE S7 offset analysis and S1 KASAN validation provides sufficient grounding even without PoC hints. However, for complex multi-stage chains involving temporal coordination or cross-cache manipulation, the absence of PoC

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

documentation creates more severe degradation: CVE-202439486, a Race-to-UAF in IPv6 MLD subsystem, achieves only 45% SSR compared to 72% for PoC-guided Race cases, as the framework must infer race window timing through statistical iteration without reference timing primitives.

15

Related documents

• PrimSynth: An Agentic Approach to Discover, Validate, and Synthesize Exploit Primitives for Linux Kernel Vulnerabilities#924795
• PrimSynth: An Agentic Approach to Discover, Validate, and Synthesize Exploit Primitives for Linux Kernel Vulnerabilities#920561
• Patch2Vuln: Agentic Reconstruction of Vulnerabilities from Linux Distribution Binary Patches#160713
• Harvest Season for SLUB: From io_uring vulnerability to Novel Sheaf-Based Exploitation Techniques#1141923
• Harvest Season for SLUB: From io_uring vulnerability to Novel Sheaf-Based Exploitation Techniques#1122193