SymSyz: Improving Hybrid Kernel Fuzzing With Environment Synchronization and Optimized Symbolic Execution

Abstract

Hybrid kernel fuzzing combines kernel fuzzing and symbolic execution: symbolic execution resolves hard-to-reach branch conditions, while kernel fuzzing mitigates path explosion. This collaboration has shown strong potential for uncovering deep kernel vulnerabilities. However, existing approaches have not fully accounted for the challenges introduced by the kernel’s persistent state, concurrent task execution, and large codebase, leading to (1) inconsistent execution environments between fuzzer and symbolic engine, (2) excessive symbolic tracking overhead, and (3) inefficient constraint solving. We present SymSyz, a hybrid kernel fuzzing framework that addresses these challenges with three techniques: Snapshot-Driven Environment Synchronization for state consistency, Origin-Scoped Symbolic Execution to reduce symbolic tracking overhead, and Priority-Guided Constraint Solving to improve solving efficiency. As a result, SymSyz improves coverage by up to 27%, achieves equivalent coverage levels with a speedup of up to $2.2\times $ , and delivers a symbolic tracking speedup of $5.6\times $ compared to the state-of-the-art kernel fuzzers. It detected 9 additional bugs on a legacy kernel and 13 previously unknown bugs on the latest Linux kernel, with 4 confirmed and 2 CNNVD IDs assigned.