Inferring 1-Minimal Trigger Configurations for Assessing Linux Kernel CVE Triggerability

2026-08-15

AI Summary

This study addresses the lack of CVE trigger assessment and configuration redundancy in Linux kernels by proposing FCC, a framework that automatically infers 1-minimal trigger configurations satisfying both build-time and runtime constraints. Integrating Kconfig constraint solving, implicit dependency completion, and topology-guided minimization, FCC is the first to generate auditable trigger boundaries validated via olddefconfig. Experimental results demonstrate that the configuration success rate increases from 62.5% to 96.6%, while the average candidate size is reduced by 78.7%. These improvements significantly lower evaluation overhead and effectively enable vendors to precisely determine CVE triggerability within specific deployments.

Abstract

Vendors assessing Linux kernel CVEs need to know whether a bug is triggerable under production-tailored configurations, not merely whether a version is affected, yet upstream reproducers and vulnerability databases rarely provide configuration-level context. We study minimal trigger-configuration inference: given a CVE entry and a target kernel version (optionally a baseline .config), we synthesize a Kconfig-satisfiable option set that remains effective after make olddefconfig and, when a reproducer is available, still triggers under a specified evaluation protocol; we then prune it to a 1-minimal (subset-minimal) boundary for evaluation. Our framework FCC links vulnerability cues to build-system symbols, completes implicit prerequisites under olddefconfig feedback to avoid silent rollback, and performs runtime-validated minimization guided by dependency topology. We evaluate on KernJC and KernelCTF, totaling 88 CVEs across multiple kernel versions. On the 88-CVE set, FCC improves the post-make olddefconfig configuration success rate from 62.5% (55/88) to 96.6% (85/88) over an olddef-only injection baseline; on the KernJC set, FCC reduces the average candidate set size by 78.7% compared to KernJC (Avg. 14.72 vs. 69.00 options per CVE). A stage-wise analysis of time and token costs shows that Stage I dominates overhead, while CVE-focused evidence selection substantially reduces this cost. By returning an effective and auditable 1-minimal configuration boundary, FCC helps vendors scope triggerability against their deployment configurations with a clear, tool-supported decision line.

Problem

• Linux Kernel CVE
• Triggerability Assessment
• Minimal Trigger Configuration
• Kconfig
• Production Configuration

Innovation

• 1-Minimal Trigger Configuration
• Linux Kernel CVE
• Kconfig Dependency Topology
• Runtime-Validated Minimization
• olddefconfig Feedback