Why Kernel Exploitation Matters
- The kernel is the most privileged software on the machine: it mediates every access to memory, files, devices, and other processes.
- A single kernel bug therefore means full system compromise: bypass all user-space sandboxes, containers, and permission checks at once.
- The usual attacker goal is local privilege escalation (LPE): start as an unprivileged user and become
root(uid 0) — or defeat a browser / container sandbox. - Kernel bugs are the top prize in real-world attacks: browser and mobile 0-day chains almost always end with a kernel LPE to escape the sandbox.
Key Takeaway
User-space mitigations do not matter if the kernel beneath them can be subverted. The kernel is the last line — and the biggest target.