#NullconBerlin2025 | Linux Kernel Runtime Guard (LKRG) 1.0 by Solar Designer

In this talk, Solar Designer presents the Linux Kernel Runtime Guard (LKRG) 1.0, a Linux kernel module designed for runtime integrity checking and detection of security vulnerabilities. The session delves into LKRG's security and threat models, explaining its operational mechanics and its role within the broader context of kernel hardening and eBPF. The speaker discusses the challenges of maintaining a complex out-of-tree module that supports various kernel versions, as well as the effectiveness of LKRG against rootkits and exploits, including past bypasses and their implications. Additionally, the talk touches on the project's evolution, future enhancements for self-protection and user-space attack detection, and may include a live demo or Q&A if time allows.