Overview
An Ikotas Labs engineer successfully exploited hardened-v1-7.2-rc5, the new target in Google’s Linux kernel vulnerability reward program, kernelCTF, using an undisclosed 0-day vulnerability. This is the first successful exploitation of the target by a Japanese researcher.
The exploit succeeded in all 20 trials, achieving 100% stability. Its average successful runtime was 0.00274 seconds, producing a score of 299.99726 out of 300. The target carries a $71,337 reward.
What Is Google kernelCTF?
kernelCTF is a Linux kernel vulnerability reward program operated as part of the Google Vulnerability Reward Program.
Unlike a conventional CTF with prepared challenges, kernelCTF requires researchers to discover previously undisclosed vulnerabilities in the Linux kernel and develop working exploits for them. Finding a vulnerability alone is not enough. Researchers must achieve privilege escalation and reliably capture a flag in an environment protected by extensive security mitigations.
Vulnerabilities are reported to the Linux kernel developers, and the exploit and its techniques are published after a fix is released. The program is designed not only to test offensive capability, but also to turn new exploitation knowledge into stronger defenses for the Linux kernel ecosystem.
A New Target with Major Attack Paths Removed
The new hardened target is based on Linux 7.2-rc5 and adds multiple protections intended to block techniques commonly used in kernel exploitation.
| Mitigation or restriction | Purpose |
|---|---|
| kCFI + IBT | Prevents attackers from redirecting execution through invalid control-flow paths |
| SLAB_VIRTUAL | Separates internal kernel memory layouts to make memory corruption harder to exploit |
| KMALLOC_PARTITION_TYPED | Partitions allocations by data type, making cross-object attacks more difficult |
| io_uring, user namespaces, TLS, and other subsystems disabled | Reduces the attack surface and removes features often useful in privilege-escalation chains |
As more mitigations are enabled, turning a vulnerability into a working privilege-escalation exploit becomes substantially harder. In this case, our engineer built a stable exploit from a newly discovered 0-day despite the sharply reduced attack surface.
20 Successful Runs and the Top Score at the Deadline
kernelCTF does not reward an exploit that succeeds only once by chance. The score is based on stability across 20 trials and the time required to retrieve the flag. A submission must achieve at least 70% stability to pass, and the maximum possible score is 300.
Our engineer’s submission succeeded in all 20 trials, reaching 100% stability. On the public response board after submissions closed on October 23, 2026, it ranked first with a score of 299.9973.
The result reflects not only the ability to discover a vulnerability, but also the engineering required to bypass current mitigations and turn the flaw into an exploit that runs reliably in a fraction of a second.
Disclosure of Technical Details
Technical details of the vulnerability will remain private until the Linux kernel fix and the kernelCTF disclosure process are complete. We plan to publish the exploit and its techniques afterward in accordance with the program rules.
Ikotas Labs provides 0-day vulnerability research, exploit development, and attacker-led security assessments for the Linux kernel and other major software. Please contact us to discuss your security needs.