Directed Real-time Linux Fuzzing with Configuration Awareness

Rt-Linux is a branch of the Linux kernel with modifications to meet real-time requirements, whose components are often less tested due to their deep integration with kernel logic and their dependence on certain configurations, which complicate traditional testing approaches. These challenges make it difficult to achieve comprehensive coverage of Rt-Linux ’s unique code sections, leaving systems vulnerable to bugs. We present DRLF-C , a configuration-aware directed fuzzer tailored for Rt-Linux , enabling efficient testing of its unique code sections. DRLF-C constructs a kernel-level weighted callgraph to prioritize input sequences closer to the target code and integrates static and dynamic configurations to test in realistic scenarios. Evaluations show that DRLF-C achieves a 24.70% increase in target coverage compared to Syzkaller and discovers 13 previously unknown bugs, now fixed by the Rt-Linux team. DRLF-C is currently integrated into Alibaba’s CI/CD pipeline of operating systems for continuous testing.