Automated patch-based reproduction of linux kernel bugs using llms and fuzzing
SyzHarness: Patch-Based Kernel Bug Reproduction with LLM-Synthesized Fuzzing Harnesses
Cryptography and SecurityArtificial Intelligence
Summary
Reproducing bugs in the Linux kernel automatically helps fix and test software more efficiently, but it’s hard to do. The authors combine AI language models with a smart testing method called fuzzing to create small programs that focus on the exact parts of code causing bugs. Their approach makes testing much better by finding the right inputs that trigger bugs. They tested this on real Linux kernel bugs and succeeded most of the time, improving over earlier methods.
What this means in practice
- •For linux kernel developers: Automatically recreate and test bug fixes to verify and debug kernel vulnerabilities using only patches.
- •For security testing teams: Enhance vulnerability triage and regression testing by reproducing kernel bugs more reliably with automated harness generation.
Authors
Xingyu Li, Juefei Pu, Haonan Li, Arrdya Srivastav, Kareem Shehada, Srikanth V. Krishnamurthy, Zhiyun Qian
Abstract
Automated kernel vulnerability reproduction is essential for bug triage, patch validation, and regression testing, but still lacks an effective and efficient solution. The core challenge is twofold: a reproducer must first recover the trigger scaffold needed to reach the vulnerable state and determine the precise concrete values that actually trigger the bug. Existing directed fuzzing approaches are ineffective at recovering the necessary trigger scaffold, while LLM- only generation is brittle because it struggles with concrete-value discovery and runtime nondeterminism. We design SyzHarness, a framework that combines LLM reasoning with coverage-guided fuzzing for patch-based Linux kernel vulnerability reproduction. Given a patch, SyzHarness uses an LLM agent grounded by code navigation tools to synthesize a parameterized fuzzing harness that fixes the prerequisite setup logic while exposing only uncertain, bug- critical input parameters to be mutated by Syzkaller. SyzHarness then translates this harness into a Syzkaller- compatible interface and iteratively refines it using hierarchical reachability feedback. We evaluate SyzHarness on multiple datasets of triggerable real-world Linux kernel vulnerabilities. On 100 KernelCTF cases, SyzHarness achieves a 78% bug reproduction success rate. On the SyzDirect benchmark, SyzHarness achieves a 73% bug reproduction success rate, substantially outperforming prior directed greybox fuzzing. On 50 recent, known-triggerable syzbot bugs fixed after March 2026, SyzHarness reproduces 40/50 (80%) using only the fix commits as input.