Packet-syscall coordinated fuzzing for linux kernel network stack

Guoyu Yin

doi:10.1016/j.cose.2026.105141

Packet-syscall coordinated fuzzing for linux kernel network stack

2026-09-11

0

PRE

AI

DOI：10.1016/j.cose.2026.105141

Original

Original request for help

Save

Abstract

En 中文

The Linux kernel network stack is a safety-critical subsystem that manages network communications, such as TCP/IP session handling and UDP datagram routing. However, effectively fuzzing the kernel network stack presents significant challenges: large portions of code are disabled by static configurations; generating network-specific inputs for both syscalls and packets is difficult; and testing the interplay between syscall execution and packet injection requires precise coordination. In this paper, we introduce Pacaller, a packet-syscall coordinated fuzzer designed for the kernel network stack. Pacaller first performs automated configuration analysis to enhance code reachability. Then, Pacaller extracts network resources from the kernel source code to generate network-specific syscall specifications and packet models. Finally, Pacaller coordinates syscall execution with packet injection to test their complex interactions within the network stack. We implemented and evaluated Pacaller on four recent versions of the Linux kernel, discovering 26 previously unknown bugs (16 confirmed, 10 fixed). Pacaller also achieved 13.3% to 22.3% higher network stack coverage than Syzkaller, SyzGen++, KernelGPT, Syz-TCP, and TRON. These results demonstrate that Pacaller significantly improves the effectiveness of fuzzing the kernel network stack.

Packet-syscall coordinated fuzzing for linux kernel network stack

Abstract

Journal

Organization