Automatic Detection of Reference Counting Bugs in Linux Kernel Drivers
Fuente:
arXiv
Saved in:
| Main Authors: | , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866910223318384640 |
|---|---|
| author | Hattori, Joe Kobayashi, Naoki Sakayori, Ken |
| author_facet | Hattori, Joe Kobayashi, Naoki Sakayori, Ken |
| contents | Reference counting bugs in Linux kernel drivers can lead to severe resource mismanagement and security vulnerabilities. We introduce DrvHorn, a novel automated tool to detect these bugs by reducing reference counting verification to an assertion checking problem leveraging the Linux driver interface. Through efficient modeling of the Linux kernel and aggressive program slicing, DrvHorn discovered 545 bugs, of which 424 were previously unknown, across all platform drivers in v6.6 Linux kernel, with a lower false positive rate of 29.9% compared to prior studies. To address the root causes of these newly discovered bugs, we submitted patches to the Linux kernel, and 45 of them were merged. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2605_13246 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Automatic Detection of Reference Counting Bugs in Linux Kernel Drivers Hattori, Joe Kobayashi, Naoki Sakayori, Ken Cryptography and Security Software Engineering Reference counting bugs in Linux kernel drivers can lead to severe resource mismanagement and security vulnerabilities. We introduce DrvHorn, a novel automated tool to detect these bugs by reducing reference counting verification to an assertion checking problem leveraging the Linux driver interface. Through efficient modeling of the Linux kernel and aggressive program slicing, DrvHorn discovered 545 bugs, of which 424 were previously unknown, across all platform drivers in v6.6 Linux kernel, with a lower false positive rate of 29.9% compared to prior studies. To address the root causes of these newly discovered bugs, we submitted patches to the Linux kernel, and 45 of them were merged. |
| title | Automatic Detection of Reference Counting Bugs in Linux Kernel Drivers |
| topic | Cryptography and Security Software Engineering |
| url | https://arxiv.org/abs/2605.13246 |