The epoll uaf
Summary
Detailed technical analysis of a Linux epoll use-after-free bug discovered by Nicholas Carlini and fixed by a kernel commit. The post explains how the race occurs, the memory-management mechanisms involved (RCU, SLUB), the attempted cross-cache exploitation, and the fix that adds an RCU-based deferral to kfree. It provides deep insight into kernel object lifetimes and defense considerations for memory-safety in the Linux kernel.