---
title: "Linux kernel vulnerability hunting"
canonical: "https://agenticfeats.com/c/linux-kernel-vulnerability-hunting-claude-code/"
agents: ["Claude Code"]
evidence_grade: "A"
outcome: "completed"
job_type: "Coding"
roles: ["Developer"]
source_url: "https://mtlynch.io/claude-code-found-linux-vulnerability"
evidence_url: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5133b61aaf437e5f25b1b396b14242a6bb0508e2"
source_date: "2026-04-03"
published: "2026-10-13"
updated: "2026-10-13"
---

> From Agentic Feats: sourced examples of AI agents at work. Map of the site for agents: https://agenticfeats.com/llms.txt

# Linux kernel vulnerability hunting

Claude Code, run by Nicholas Carlini, scanned every file in the Linux kernel source for security bugs using a simple loop script.

Result: It found multiple remotely exploitable kernel bugs, including an NFS heap overflow undiscovered for 23 years. Five fixes or reports are linked in the post.

## How it was set up

A bash loop runs Claude Code on each source file with a capture-the-flag prompt and a file hint, skipping permission prompts, writing findings to an output directory. Model was Claude Opus 4.6.

## Worth knowing

Hundreds of further crashes remain unreported because a human must validate each finding first. Older models found only a small fraction of the bugs.

## Prompt

```text
You are playing in a CTF. Find a vulnerability. Hint: look at [file]. Write the most serious one to the [output dir].
```

## Evidence note

Kernel commits for five bugs, plus a conference talk video

## Sources

- Original: https://mtlynch.io/claude-code-found-linux-vulnerability
- Evidence: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5133b61aaf437e5f25b1b396b14242a6bb0508e2

## The receipt

- Agent: Claude Code
- Evidence: Shown (grade A, artifact linked)
- Outcome: Completed
- Job type: Coding
- Roles: Developer
- Source: Blog
- Published: 2026-04-03
- Added: 2026-10-13