Fixing the Linux Kernel: Upstream Memory-Safety Contributions
The same automated research pipeline that audits npm packages now reads kernel C and has landed 0sec-authored fixes in the mainline Linux kernel, each maintainer-reviewed and flowing into stable where applicable. Here's what merged, and how.
Finding a bug is the easy half. The hard half, the half that actually proves a security pipeline works, is getting a maintainer to accept your fix into the code that ships to everyone.
Over the past few weeks, 0sec’s automated security research has done exactly that in the place where the bar is highest: the mainline Linux kernel. Not a fork, not a write-up, not a “potential issue” filed into a tracker. Real patches, reviewed by the subsystem maintainers, merged into Linus Torvalds’ tree (or accepted upstream and queued for it), and flowing out to the stable trees that distributions ship.
Every one carries the same line in its permanent git history: “Found by 0sec automated security-research tooling.”
What landed
| Subsystem | Bug class | Status | Commit |
|---|---|---|---|
| Bluetooth (LE Audio CIS) | use-after-free | merged to mainline + stable | bfea6091 |
| TIPC (crypto) | use-after-free | merged to mainline + queued across supported stable trees | bda33488 |
| mac802154 (802.15.4 crypto) | missing copy-on-write | merged to mainline + queued across supported stable trees | 84a04eb5 |
| mlx5e (MACsec) | metadata lifetime use-after-free | merged to mainline + queued to stable | de74d8fd |
| xen-blkfront | split-request double completion | merged to mainline | 5d727203 |
| NFC (digital layer) | stack buffer overflow | maintainer tree, not yet mainline | 5cb0e4ac |
| NFC (LLCP) | TLV integer underflow + OOB read | maintainer tree, not yet mainline | ed85d4cb |
| accel/amdxdna (AMD NPU) | NULL-deref DoS (missing command-BO check) | merged to mainline + queued to stable | 261c1fe3 |
| accel/amdxdna (AMD NPU) | NULL-deref DoS (missing submit-op check) | merged to mainline + queued to stable | 38953513 |
| Marvell mwifiex (tdls) | NULL-deref on missing HT-oper IE | merged to mainline | c3d68e29 |
| mac802154 (802.15.4 llsec) | frames shorter than the auth tag | merged to mainline | fd3a3f28 |
| mctp-serial | RX buffer overflow on zero-length frames | merged to mainline + backported to stable | 793b9b72 |
| vxlan | missing CAP_NET_ADMIN on changelink | merged to mainline + queued to stable | 3a61bd96 |
| geneve | missing CAP_NET_ADMIN on changelink | merged to mainline + queued to stable | 8efb8f8b |
Each mainline row links to the real commit, verifiable in the kernel’s own git, with our authorship attached.
Correction, 2026-08-02. When this was first published, the two NFC rows said “merged to mainline” and linked
git.kernel.org/linus/.... That was wrong. Both fixes were accepted by the NFC maintainer and sit in the NFC subsystem tree awaiting a pull; neither is in Linus’s tree, and thegit.kernel.org/linus/links did not resolve. The mistake was in how we checked: a GitHub API call that returns 200 for any commit anywhere in thetorvalds/linuxfork network, including maintainer trees. The correct check iscompare/<sha>...masterreturningahead, and it returnsdivergedfor both. The status column now says what is true, and the two links are removed rather than left pointing at nothing.The same re-check found four merged fixes this table was missing, which are now added: mac802154 assoclen, mctp-serial, vxlan and geneve. Corrected total: 12 patches across 10 findings in mainline, none of them NFC.
How the pipeline gets there
The kernel work runs on the same principle as our package research: read the source, trace the data, prove the bug, then propose the minimal correct fix. The difference is the rigor the kernel community (rightly) demands before anything merges.
- Source analysis surfaces a candidate: an attacker-influenced length feeding a copy, a pointer used after a concurrent free, or a crypto path missing a guard its sibling already has.
- Verification before sending. Every patch is generated byte-exact from a real tree, apply-checked, and compile-clean. Where a bug has a public reproducer, we confirm the fix against it. For the NFC overflow, that meant a
#syz testrun on syzbot’s reproducer, which came backTested-by: syzbotbefore the patch ever reached a maintainer. - Upstream review. Maintainers and reviewers at Intel, Red Hat, and across the kernel community reviewed the patches. The TIPC fix carries three independent
Reviewed-bytags. The NFC and 802.15.4 fixes carry maintainer review from Intel.
The TIPC one shows exactly how these get found. The encrypt path had already been fixed for a use-after-free during network-namespace teardown, but the decrypt twin was left unguarded. That is incomplete-fix variant analysis: take a known, patched bug and ask whether its mirror image was missed. It was.
What this proves
Anyone can publish a “potential issue.” The bar that actually counts is the one almost no one clears: twelve 0sec-authored patches, across ten kernel findings and nine subsystems, merged into mainline Linux in a matter of weeks, each reviewed by the subsystem’s own maintainers, with stable backports flowing where applicable. (Published as “ten patches, nine findings, eight subsystems”; corrected 2026-08-02 along with the table above, which had two NFC fixes in the wrong column and four merged fixes missing.)
That’s not “we found something.” It’s in the tree, with our name on it.