SyzCrash: Crash-Context-Guided Directed Fuzzing for Exploitability Risk Assessment of Linux Kernal Bugs

The surge in Linux kernel vulnerabilities poses a significant challenge for security analysts, as the scale of bug reports far outstrips manual patching capacity. Assessing the exploitability risk of Linux kernel bugs is vital for prioritizing bug repair efforts, yet the first discovered crash report provides a limited view of the bug’s exploitability risk, potentially underestimating its true security impact. We introduce SyzCrash, a directed fuzzing framework that utilizes post-crash traces to guide the exploitability risk escalation in the Linux kernel. To mitigate kernel panic instability, SyzCrash employs a loadable kernel module with panic_notifier hook to capture post-crash kCOV and ftrace data. By combining context similarity feedback with a two-phase mutation strategy, the framework preserves the original crash context while systematically exploring proximate execution paths. Evaluation on a benchmark of 108 real-world Linux kernel bugs shows that SyzCrash achieves a 72.22% escalation success rate in bug risk escalation, outperforming state-of-the-art approaches in both efficacy and speed. These results highlight its capability to systematically uncover hidden security risks and assist developers in bug prioritization and patching.