{
 "techniques": {
  "Cov": "coverage/execution",
  "Inp": "input-structure/spec inference",
  "Dep": "dependency/sequence inference",
  "Sch": "mutation/task scheduling",
  "Sta": "state-aware",
  "Dir": "directed",
  "Con": "concurrency interleaving",
  "Emu": "device emulation",
  "Tnt": "taint/dataflow",
  "Typ": "typestate/lifecycle",
  "Sym": "symbolic/path-sensitive",
  "Min": "spec/pattern mining",
  "ML": "learned models"
 },
 "systems": [
  {
   "system": "kAFL",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "generic",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Cov"
   ],
   "llm": false,
   "title": "kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels",
   "authors": "Sergej Schumilo and Cornelius Aschermann and Robert Gawlik and Sebastian Schinzel and Thorsten Holz",
   "venue": "USENIX Security Symposium",
   "year": "2017",
   "url": "",
   "bibkey": "kafl"
  },
  {
   "system": "Unicorefuzz",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "generic",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Cov"
   ],
   "llm": false,
   "title": "Unicorefuzz: On the Viability of Emulation for Kernelspace Fuzzing",
   "authors": "Dominik Christian Maier and Benedikt Radtke and Bastian Harren",
   "venue": "USENIX Workshop on Offensive Technologies (WOOT)",
   "year": "2019",
   "url": "",
   "bibkey": "unicorefuzz"
  },
  {
   "system": "Agamotto",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "driver",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Cov",
    "Emu"
   ],
   "llm": false,
   "title": "Agamotto: Accelerating Kernel Driver Fuzzing with Lightweight Virtual Machine Checkpoints",
   "authors": "Dokyung Song and others",
   "venue": "USENIX Security Symposium",
   "year": "2020",
   "url": "",
   "bibkey": "agamotto"
  },
  {
   "system": "Horus",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "generic",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Cov"
   ],
   "llm": false,
   "title": "Horus: Accelerating Kernel Fuzzing through Efficient Host-VM Memory Access Procedures",
   "authors": "Jianzhong Liu and Yuheng Shen and Yiru Xu and Hao Sun and Yu Jiang",
   "venue": "ACM Transactions on Software Engineering and Methodology",
   "year": "2023",
   "url": "",
   "bibkey": "horus"
  },
  {
   "system": "BoKASAN",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "generic",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Cov"
   ],
   "llm": false,
   "title": "BoKASAN: Binary-only Kernel Address Sanitizer for Effective Kernel Fuzzing",
   "authors": "Mingi Cho and Dohyeon An and Hoyong Jin and Taekyoung Kwon",
   "venue": "USENIX Security Symposium",
   "year": "2023",
   "url": "",
   "bibkey": "bokasan"
  },
  {
   "system": "MoonShine",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "core",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Dep",
    "Cov",
    "Tnt"
   ],
   "llm": false,
   "title": "MoonShine: Optimizing OS Fuzzer Seed Selection with Trace Distillation",
   "authors": "Shankara Pailoor and Andrew Aday and Suman Jana",
   "venue": "USENIX Security Symposium",
   "year": "2018",
   "url": "",
   "bibkey": "moonshine"
  },
  {
   "system": "HEALER",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "core",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Dep",
    "Cov"
   ],
   "llm": false,
   "title": "HEALER: Relation Learning Guided Kernel Fuzzing",
   "authors": "Hao Sun and others",
   "venue": "ACM SIGOPS Symposium on Operating Systems Principles",
   "year": "2021",
   "url": "",
   "bibkey": "healer"
  },
  {
   "system": "ACTOR",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "core",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sta",
    "Dep",
    "Tnt"
   ],
   "llm": false,
   "title": "ACTOR: Action-Guided Kernel Fuzzing",
   "authors": "Marius Fleischer and others",
   "venue": "USENIX Security Symposium",
   "year": "2023",
   "url": "",
   "bibkey": "actor"
  },
  {
   "system": "MOCK",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "core",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Dep",
    "Sch",
    "ML",
    "Cov"
   ],
   "llm": false,
   "title": "MOCK: Optimizing Kernel Fuzzing Mutation with Context-aware Dependency",
   "authors": "Jiacheng Xu and others",
   "venue": "Network and Distributed System Security Symposium",
   "year": "2024",
   "url": "",
   "bibkey": "mock"
  },
  {
   "system": "SyzVegas",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "core",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sch",
    "Cov"
   ],
   "llm": false,
   "title": "SyzVegas: Beating Kernel Fuzzing Odds with Reinforcement Learning",
   "authors": "Daimeng Wang and others",
   "venue": "USENIX Security Symposium",
   "year": "2021",
   "url": "",
   "bibkey": "syzvegas"
  },
  {
   "system": "Snowplow",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "core",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sch",
    "ML",
    "Dir",
    "Cov"
   ],
   "llm": false,
   "title": "Snowplow: Effective Kernel Fuzzing with a Learned White-box Test Mutator",
   "authors": "Sishuai Gong and Rui Wang and Deniz Alt\\inbuken and Pedro Fonseca and Petros Maniatis",
   "venue": "ACM International Conference on Architectural Support for Programming Languages and Operating Systems",
   "year": "2025",
   "url": "",
   "bibkey": "snowplow"
  },
  {
   "system": "StateFuzz",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "driver",
   "bugClass": "mem,logic",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sta",
    "Sym",
    "Sch"
   ],
   "llm": false,
   "title": "StateFuzz: System Call-Based State-Aware Linux Driver Fuzzing",
   "authors": "Bodong Zhao and others",
   "venue": "USENIX Security Symposium",
   "year": "2022",
   "url": "",
   "bibkey": "statefuzz"
  },
  {
   "system": "HFL",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Hybrid",
   "target": "core",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sym",
    "Dep",
    "Inp",
    "Tnt",
    "Sta"
   ],
   "llm": false,
   "title": "HFL: Hybrid Fuzzing on the Linux Kernel",
   "authors": "Kyungtae Kim and others",
   "venue": "Network and Distributed System Security Symposium",
   "year": "2020",
   "url": "",
   "bibkey": "hfl"
  },
  {
   "system": "CountDown",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "core",
   "bugClass": "mem (refcnt)",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sta",
    "Dep",
    "Sch"
   ],
   "llm": false,
   "title": "CountDown: Refcount-guided Fuzzing for Exposing Temporal Memory Errors in Linux Kernel",
   "authors": "Shuangpeng Bai and Zhechang Zhang and Hong Hu",
   "venue": "ACM SIGSAC Conference on Computer and Communications Security",
   "year": "2024",
   "url": "",
   "bibkey": "countdown"
  },
  {
   "system": "Bin-Cov",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "generic",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Cov",
    "Tnt"
   ],
   "llm": false,
   "title": "Leveraging Binary Coverage for Effective Generation Guidance in Kernel Fuzzing",
   "authors": "Jianzhong Liu and Yuheng Shen and Yiru Xu and Yu Jiang",
   "venue": "ACM SIGSAC Conference on Computer and Communications Security",
   "year": "2024",
   "url": "",
   "bibkey": "liu2024leveraging"
  },
  {
   "system": "DIFUZE",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "driver",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Inp",
    "Sym",
    "Tnt"
   ],
   "llm": false,
   "title": "DIFUZE: Interface Aware Fuzzing for Kernel Drivers",
   "authors": "Jake Corina and others",
   "venue": "ACM SIGSAC Conference on Computer and Communications Security",
   "year": "2017",
   "url": "",
   "bibkey": "difuze"
  },
  {
   "system": "IMF",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "API (macOS)",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Dep",
    "Inp",
    "Min"
   ],
   "llm": false,
   "title": "IMF: Inferred Model-based Fuzzer",
   "authors": "HyungSeok Han and Sang Kil Cha",
   "venue": "ACM SIGSAC Conference on Computer and Communications Security",
   "year": "2017",
   "url": "",
   "bibkey": "imf"
  },
  {
   "system": "DR. FUZZ",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "driver",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Inp",
    "Sta",
    "Sch",
    "Tnt",
    "Cov"
   ],
   "llm": false,
   "title": "Semantic-Informed Driver Fuzzing Without Both the Hardware Devices and the Emulators",
   "authors": "Wenjia Zhao and Kangjie Lu and Qiushi Wu and Yong Qi",
   "venue": "Network and Distributed System Security Symposium",
   "year": "2022",
   "url": "",
   "bibkey": "drfuzz"
  },
  {
   "system": "PrIntFuzz",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "driver",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Emu",
    "Inp",
    "Tnt",
    "Sym",
    "Cov"
   ],
   "llm": false,
   "title": "PrIntFuzz: Fuzzing Linux Drivers via Automated Virtual Device Simulation",
   "authors": "Zheyu Ma and others",
   "venue": "ACM SIGSOFT International Symposium on Software Testing and Analysis",
   "year": "2022",
   "url": "",
   "bibkey": "printfuzz"
  },
  {
   "system": "KextFuzz",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "drv (macOS)",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Cov",
    "Inp",
    "Tnt",
    "Dep"
   ],
   "llm": false,
   "title": "KextFuzz: Fuzzing macOS Kernel EXTensions on Apple Silicon via Exploiting Mitigations",
   "authors": "Tingting Yin and others",
   "venue": "USENIX Security Symposium",
   "year": "2023",
   "url": "",
   "bibkey": "kextfuzz"
  },
  {
   "system": "NTFUZZ",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "drv (Win)",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Inp",
    "Tnt",
    "Sch"
   ],
   "llm": false,
   "title": "NTFUZZ: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis",
   "authors": "Jaeseung Choi and Kangsu Kim and Daejin Lee and Sang Kil Cha",
   "venue": "IEEE Symposium on Security and Privacy (S&P)",
   "year": "2021",
   "url": "",
   "bibkey": "ntfuzz"
  },
  {
   "system": "JANUS",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "FS",
   "bugClass": "mem,sem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sta",
    "Sch",
    "Cov"
   ],
   "llm": false,
   "title": "Fuzzing File Systems via Two-Dimensional Input Space Exploration",
   "authors": "Wen Xu and Hyungon Moon and Sanidhya Kashyap and Po-Ning Tseng and Taesoo Kim",
   "venue": "IEEE Symposium on Security and Privacy (S&P)",
   "year": "2019",
   "url": "",
   "bibkey": "janus"
  },
  {
   "system": "Hydra",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "FS",
   "bugClass": "sem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sta",
    "Sch",
    "Cov"
   ],
   "llm": false,
   "title": "Finding Semantic Bugs in File Systems with an Extensible Fuzzing Framework",
   "authors": "Seulbae Kim and others",
   "venue": "ACM SIGOPS Symposium on Operating Systems Principles",
   "year": "2019",
   "url": "",
   "bibkey": "hydra_sosp"
  },
  {
   "system": "Razzer",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Hybrid",
   "target": "conc.",
   "bugClass": "conc",
   "focus": "",
   "automation": "",
   "techniques": [
    "Con",
    "Dir",
    "Cov",
    "Tnt"
   ],
   "llm": false,
   "title": "Razzer: Finding Kernel Race Bugs through Fuzzing",
   "authors": "Dae R. Jeong and Kyungtae Kim and Basavesh Shivakumar and Byoungyoung Lee and Insik Shin",
   "venue": "IEEE Symposium on Security and Privacy (S&P)",
   "year": "2019",
   "url": "",
   "bibkey": "razzer"
  },
  {
   "system": "SegFuzz",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "conc.",
   "bugClass": "conc",
   "focus": "",
   "automation": "",
   "techniques": [
    "Con",
    "Cov"
   ],
   "llm": false,
   "title": "SegFuzz: Segmentizing Thread Interleaving to Discover Kernel Concurrency Bugs through Fuzzing",
   "authors": "Dae R. Jeong and Byoungyoung Lee and Insik Shin and Youngjin Kwon",
   "venue": "IEEE Symposium on Security and Privacy (S&P)",
   "year": "2023",
   "url": "",
   "bibkey": "segfuzz"
  },
  {
   "system": "Snowboard",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "conc.",
   "bugClass": "conc",
   "focus": "",
   "automation": "",
   "techniques": [
    "Con",
    "Sch",
    "Dep"
   ],
   "llm": false,
   "title": "Snowboard: Finding Kernel Concurrency Bugs through Systematic Inter-thread Communication Analysis",
   "authors": "Sishuai Gong and Deniz Alt\\inbuken and Pedro Fonseca and Petros Maniatis",
   "venue": "ACM SIGOPS Symposium on Operating Systems Principles",
   "year": "2021",
   "url": "",
   "bibkey": "snowboard"
  },
  {
   "system": "SyzDirect",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "directed",
   "bugClass": "mem,logic",
   "focus": "",
   "automation": "",
   "techniques": [
    "Dir",
    "Dep",
    "Inp",
    "Sch",
    "Tnt"
   ],
   "llm": false,
   "title": "SyzDirect: Directed Greybox Fuzzing for Linux Kernel",
   "authors": "Xin Tan and others",
   "venue": "ACM SIGSAC Conference on Computer and Communications Security",
   "year": "2023",
   "url": "",
   "bibkey": "syzdirect"
  },
  {
   "system": "SyzRisk",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "regression",
   "bugClass": "mem,logic",
   "focus": "",
   "automation": "",
   "techniques": [
    "Dir",
    "Sch",
    "Cov"
   ],
   "llm": false,
   "title": "SyzRisk: A Change-Pattern-Based Continuous Kernel Regression Fuzzer",
   "authors": "Gwangmu Lee and Duo Xu and Solmaz Salimi and Byoungyoung Lee and Mathias Payer",
   "venue": "ACM Asia Conference on Computer and Communications Security (AsiaCCS)",
   "year": "2024",
   "url": "",
   "bibkey": "syzrisk"
  },
  {
   "system": "SyzGen",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "spec-gen",
   "bugClass": "n/a",
   "focus": "",
   "automation": "",
   "techniques": [
    "Inp",
    "Dep",
    "Sym",
    "Cov",
    "Min"
   ],
   "llm": false,
   "title": "SyzGen: Automated Generation of Syscall Specification of Closed-Source macOS Drivers",
   "authors": "Weiteng Chen and Yu Wang and Zheng Zhang and Zhiyun Qian",
   "venue": "ACM SIGSAC Conference on Computer and Communications Security",
   "year": "2021",
   "url": "",
   "bibkey": "syzgen"
  },
  {
   "system": "KSG",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "spec-gen",
   "bugClass": "n/a",
   "focus": "",
   "automation": "",
   "techniques": [
    "Inp",
    "Sym",
    "Tnt"
   ],
   "llm": false,
   "title": "KSG: Augmenting Kernel Fuzzing with System Call Specification Generation",
   "authors": "Hao Sun and Yuheng Shen and Jianzhong Liu and Yiru Xu and Yu Jiang",
   "venue": "USENIX Annual Technical Conference",
   "year": "2022",
   "url": "",
   "bibkey": "ksg"
  },
  {
   "system": "SyzDescribe",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Static",
   "target": "spec-gen",
   "bugClass": "n/a",
   "focus": "",
   "automation": "",
   "techniques": [
    "Inp",
    "Dep",
    "Tnt"
   ],
   "llm": false,
   "title": "SyzDescribe: Principled, Automated, Static Generation of Syscall Descriptions for Kernel Drivers",
   "authors": "Yu Hao and others",
   "venue": "IEEE Symposium on Security and Privacy (S&P)",
   "year": "2023",
   "url": "",
   "bibkey": "syzdescribe"
  },
  {
   "system": "SyzGen++",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "spec-gen",
   "bugClass": "n/a",
   "focus": "",
   "automation": "",
   "techniques": [
    "Dep",
    "Inp",
    "Sym",
    "Cov"
   ],
   "llm": false,
   "title": "SyzGen++: Dependency Inference for Augmenting Kernel Driver Fuzzing",
   "authors": "Weiteng Chen and others",
   "venue": "IEEE Symposium on Security and Privacy (S&P)",
   "year": "2024",
   "url": "",
   "bibkey": "chen2024syzgen++"
  },
  {
   "system": "FuzzNG",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "core",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Inp",
    "Cov"
   ],
   "llm": false,
   "title": "No Grammar, No Problem: Towards Fuzzing the Linux Kernel without System-Call Descriptions",
   "authors": "Alexander Bulekov and Bandan Das and Stefan Hajnoczi and Manuel Egele",
   "venue": "Network and Distributed System Security Symposium",
   "year": "2023",
   "url": "",
   "bibkey": "bulekov2023no"
  },
  {
   "system": "KernelGPT",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Fuzzing",
   "target": "spec-gen",
   "bugClass": "n/a",
   "focus": "",
   "automation": "",
   "techniques": [
    "Inp",
    "Dep",
    "ML"
   ],
   "llm": true,
   "title": "KernelGPT: Enhanced Kernel Fuzzing via Large Language Models",
   "authors": "Chenyuan Yang and Zijie Zhao and Lingming Zhang",
   "venue": "ACM International Conference on Architectural Support for Programming Languages and Operating Systems",
   "year": "2025",
   "url": "",
   "bibkey": "kernelgpt"
  },
  {
   "system": "Enterprise",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Empirical",
   "target": "generic",
   "bugClass": "mem,conc,logic",
   "focus": "",
   "automation": "",
   "techniques": [
    "Cov"
   ],
   "llm": false,
   "title": "Industry Practice of Coverage-guided Enterprise Linux Kernel Fuzzing",
   "authors": "Heyuan Shi and others",
   "venue": "ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE)",
   "year": "2019",
   "url": "",
   "bibkey": "enterprise"
  },
  {
   "system": "Directed-Ind.",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Dynamic discovery (fuzzing)",
   "type": "Empirical",
   "target": "directed",
   "bugClass": "mem,logic",
   "focus": "",
   "automation": "",
   "techniques": [
    "Dir",
    "Inp",
    "Sch",
    "Cov"
   ],
   "llm": false,
   "title": "Industry Practice of Directed Kernel Fuzzing for Open-source Linux Distribution",
   "authors": "Heyuan Shi and others",
   "venue": "IEEE/ACM International Conference on Automated Software Engineering",
   "year": "2024",
   "url": "",
   "bibkey": "directed_industry"
  },
  {
   "system": "DR. CHECKER",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "driver",
   "bugClass": "mem,logic",
   "focus": "",
   "automation": "",
   "techniques": [
    "Tnt"
   ],
   "llm": false,
   "title": "DR. CHECKER: A Soundy Analysis for Linux Kernel Drivers",
   "authors": "Aravind Machiry and others",
   "venue": "USENIX Security Symposium",
   "year": "2017",
   "url": "",
   "bibkey": "drchecker"
  },
  {
   "system": "K-Miner",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "core",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Tnt"
   ],
   "llm": false,
   "title": "K-Miner: Uncovering Memory Corruption in Linux",
   "authors": "David Gens and Simon Schmitt and Lucas Davi and Ahmad-Reza Sadeghi",
   "venue": "Network and Distributed System Security Symposium",
   "year": "2018",
   "url": "",
   "bibkey": "kminer"
  },
  {
   "system": "CRIX",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "logic (chk)",
   "focus": "",
   "automation": "",
   "techniques": [
    "Min",
    "Tnt"
   ],
   "llm": false,
   "title": "Detecting Missing-Check Bugs via Semantic- and Context-Aware Criticalness and Constraints Inferences",
   "authors": "Kangjie Lu and Aditya Pakki and Qiushi Wu",
   "venue": "USENIX Security Symposium",
   "year": "2019",
   "url": "",
   "bibkey": "crix"
  },
  {
   "system": "LRSan",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "logic (chk)",
   "focus": "",
   "automation": "",
   "techniques": [
    "Min",
    "Tnt"
   ],
   "llm": false,
   "title": "Check It Again: Detecting Lacking-Recheck Bugs in OS Kernels",
   "authors": "Wenwen Wang and Kangjie Lu and Pen-Chung Yew",
   "venue": "ACM SIGSAC Conference on Computer and Communications Security",
   "year": "2018",
   "url": "",
   "bibkey": "lrsan"
  },
  {
   "system": "UBITect",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "mem (UBI)",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sym",
    "Tnt",
    "Typ"
   ],
   "llm": false,
   "title": "UBITect: A Precise and Scalable Method to Detect Use-before-Initialization Bugs in Linux Kernel",
   "authors": "Yizhuo Zhai and others",
   "venue": "ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE)",
   "year": "2020",
   "url": "",
   "bibkey": "ubitect"
  },
  {
   "system": "K-MELD",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "modules",
   "bugClass": "mem (leak)",
   "focus": "",
   "automation": "",
   "techniques": [
    "Min",
    "Typ",
    "Tnt",
    "Sym"
   ],
   "llm": false,
   "title": "Detecting Kernel Memory Leaks in Specialized Modules with Ownership Reasoning",
   "authors": "Navid Emamdoost and Qiushi Wu and Kangjie Lu and Stephen McCamant",
   "venue": "Network and Distributed System Security Symposium",
   "year": "2021",
   "url": "",
   "bibkey": "kmeld"
  },
  {
   "system": "Goshawk",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Min",
    "Typ",
    "Tnt",
    "Sym",
    "ML"
   ],
   "llm": false,
   "title": "Goshawk: Hunting Memory Corruptions via Structure-Aware and Object-Centric Memory Operation Synopsis",
   "authors": "Yunlong Lyu and others",
   "venue": "IEEE Symposium on Security and Privacy (S&P)",
   "year": "2022",
   "url": "",
   "bibkey": "goshawk"
  },
  {
   "system": "DCUAF",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "driver",
   "bugClass": "conc (UAF)",
   "focus": "",
   "automation": "",
   "techniques": [
    "Tnt",
    "Min"
   ],
   "llm": false,
   "title": "Effective Static Analysis of Concurrency Use-After-Free Bugs in Linux Device Drivers",
   "authors": "Jia-Ju Bai and Julia Lawall and Qiu-Liang Chen and Shi-Min Hu",
   "venue": "USENIX Annual Technical Conference",
   "year": "2019",
   "url": "",
   "bibkey": "dcuaf"
  },
  {
   "system": "DEADLINE",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "conc",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sym",
    "Tnt"
   ],
   "llm": false,
   "title": "Precise and Scalable Detection of Double-Fetch Bugs in OS Kernels",
   "authors": "Meng Xu and Chenxiong Qian and Kangjie Lu and Michael Backes and Taesoo Kim",
   "venue": "IEEE Symposium on Security and Privacy (S&P)",
   "year": "2018",
   "url": "",
   "bibkey": "xu2018precise"
  },
  {
   "system": "VulDeePecker",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "ML",
    "Tnt"
   ],
   "llm": false,
   "title": "VulDeePecker: A Deep Learning-Based System for Vulnerability Detection",
   "authors": "Zhen Li and others",
   "venue": "Network and Distributed System Security Symposium",
   "year": "2018",
   "url": "",
   "bibkey": "li2018vuldeepecker"
  },
  {
   "system": "CheQ",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "logic (chk)",
   "focus": "",
   "automation": "",
   "techniques": [
    "Min",
    "Tnt"
   ],
   "llm": false,
   "title": "Automatically Identifying Security Checks for Detecting Kernel Semantic Bugs",
   "authors": "Kangjie Lu and Aditya Pakki and Qiushi Wu",
   "venue": "European Symposium on Research in Computer Security (ESORICS)",
   "year": "2019",
   "url": "",
   "bibkey": "lu2019automatically"
  },
  {
   "system": "Uninit-Bin",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "binary",
   "bugClass": "mem (uninit)",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sym",
    "Tnt"
   ],
   "llm": false,
   "title": "Static Detection of Uninitialized Stack Variables in Binary Code",
   "authors": "Behrad Garmany and Martin Stoffel and Robert Gawlik and Thorsten Holz",
   "venue": "European Symposium on Research in Computer Security (ESORICS)",
   "year": "2019",
   "url": "",
   "bibkey": "garmany2019static"
  },
  {
   "system": "SUTURE",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "taint",
   "focus": "",
   "automation": "",
   "techniques": [
    "Tnt",
    "Sym"
   ],
   "llm": false,
   "title": "Statically Discovering High-Order Taint Style Vulnerabilities in OS Kernels",
   "authors": "Hang Zhang and others",
   "venue": "ACM SIGSAC Conference on Computer and Communications Security",
   "year": "2021",
   "url": "",
   "bibkey": "zhang2021statically"
  },
  {
   "system": "Kconfig",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "config",
   "bugClass": "logic",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sym"
   ],
   "llm": false,
   "title": "Finding Broken Linux Configuration Specifications by Statically Analyzing the Kconfig Language",
   "authors": "Jeho Oh and Necip Faz\\il Y\\ild\\iran and Julian Braha and Paul Gazzillo",
   "venue": "ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE)",
   "year": "2021",
   "url": "",
   "bibkey": "oh2021finding"
  },
  {
   "system": "KUBO",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "mem (UB)",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sym",
    "Tnt"
   ],
   "llm": false,
   "title": "KUBO: Precise and Scalable Detection of User-triggerable Undefined Behavior Bugs in OS Kernel",
   "authors": "Changming Liu and Yaohui Chen and Long Lu",
   "venue": "Network and Distributed System Security Symposium",
   "year": "2021",
   "url": "",
   "bibkey": "liu2021kubo"
  },
  {
   "system": "DEPA",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "logic",
   "focus": "",
   "automation": "",
   "techniques": [
    "Min",
    "Tnt"
   ],
   "llm": false,
   "title": "Inferring Bug Signatures to Detect Real Bugs",
   "authors": "Hao Zhong and Xiaoyin Wang and Hong Mei",
   "venue": "IEEE Transactions on Software Engineering",
   "year": "2022",
   "url": "",
   "bibkey": "zhong2020inferring"
  },
  {
   "system": "MANTA",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "container",
   "bugClass": "mem (acct)",
   "focus": "",
   "automation": "",
   "techniques": [
    "Tnt"
   ],
   "llm": false,
   "title": "Making Memory Account Accountable: Analyzing and Detecting Memory Missing-account Bugs for Container Platforms",
   "authors": "Yutian Yang and others",
   "venue": "Annual Computer Security Applications Conference (ACSAC)",
   "year": "2022",
   "url": "",
   "bibkey": "yang2022making"
  },
  {
   "system": "IncreLux",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "mem (UBI)",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sym",
    "Tnt"
   ],
   "llm": false,
   "title": "Progressive Scrutiny: Incremental Detection of UBI Bugs in the Linux Kernel",
   "authors": "Yizhuo Zhai and others",
   "venue": "Network and Distributed System Security Symposium",
   "year": "2022",
   "url": "",
   "bibkey": "zhai2022progressive"
  },
  {
   "system": "PATA",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "mem,logic",
   "focus": "",
   "automation": "",
   "techniques": [
    "Tnt",
    "Typ",
    "Sym"
   ],
   "llm": false,
   "title": "Path-Sensitive and Alias-Aware Typestate Analysis for Detecting OS Bugs",
   "authors": "Tuo Li and Jia-Ju Bai and Yulei Sui and Shi-Min Hu",
   "venue": "ACM International Conference on Architectural Support for Programming Languages and Operating Systems",
   "year": "2022",
   "url": "",
   "bibkey": "li2022path"
  },
  {
   "system": "UACatcher",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "driver",
   "bugClass": "conc (UAC)",
   "focus": "",
   "automation": "",
   "techniques": [
    "Typ",
    "Tnt",
    "Sym"
   ],
   "llm": false,
   "title": "When Top-down Meets Bottom-up: Detecting and Exploiting Use-After-Cleanup Bugs in Linux Kernel",
   "authors": "Lin Ma and others",
   "venue": "IEEE Symposium on Security and Privacy (S&P)",
   "year": "2023",
   "url": "",
   "bibkey": "ma2023top"
  },
  {
   "system": "Err-Spec",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "logic (err)",
   "focus": "",
   "automation": "",
   "techniques": [
    "Min",
    "Tnt",
    "Sym"
   ],
   "llm": false,
   "title": "Inference of Error Specifications and Bug Detection Using Structural Similarities",
   "authors": "Niels Dossche and Bart Coppens",
   "venue": "USENIX Security Symposium",
   "year": "2024",
   "url": "",
   "bibkey": "dossche2024inference"
  },
  {
   "system": "LLift",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "mem (UBI)",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sym",
    "ML"
   ],
   "llm": true,
   "title": "Enhancing Static Analysis for Practical Bug Detection: An LLM-Integrated Approach",
   "authors": "Haonan Li and Yu Hao and Yizhuo Zhai and Zhiyun Qian",
   "venue": "Proceedings of the ACM on Programming Languages",
   "year": "2024",
   "url": "",
   "bibkey": "li2024enhancing"
  },
  {
   "system": "IMMI",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "mem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Min",
    "Typ",
    "Tnt",
    "ML"
   ],
   "llm": true,
   "title": "Detecting Kernel Memory Bugs through Inconsistent Memory Management Intention Inferences",
   "authors": "Dinghao Liu and others",
   "venue": "USENIX Security Symposium",
   "year": "2024",
   "url": "",
   "bibkey": "liu2024detecting"
  },
  {
   "system": "BugLens",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "taint",
   "focus": "",
   "automation": "",
   "techniques": [
    "Tnt",
    "Sym",
    "ML"
   ],
   "llm": true,
   "title": "Towards More Accurate Static Analysis for Taint-Style Bug Detection in Linux Kernel",
   "authors": "Haonan Li and Hang Zhang and Kexin Pei and Zhiyun Qian",
   "venue": "IEEE/ACM International Conference on Automated Software Engineering",
   "year": "2025",
   "url": "",
   "bibkey": "li2025towards"
  },
  {
   "system": "UAFX",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "mem (UAF)",
   "focus": "",
   "automation": "",
   "techniques": [
    "Typ",
    "Tnt",
    "Sym"
   ],
   "llm": false,
   "title": "Statically Discover Cross-Entry Use-After-Free Vulnerabilities in the Linux Kernel",
   "authors": "Hang Zhang and Jangha Kim and Chuhong Yuan and Zhiyun Qian and Taesoo Kim",
   "venue": "Network and Distributed System Security Symposium",
   "year": "2025",
   "url": "",
   "bibkey": "zhang2025statically"
  },
  {
   "system": "SCAD",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Hybrid",
   "target": "network",
   "bugClass": "sem",
   "focus": "",
   "automation": "",
   "techniques": [
    "Sym",
    "Tnt"
   ],
   "llm": false,
   "title": "SCAD: Towards a Universal and Automated Network Side-Channel Vulnerability Detection",
   "authors": "Keyu Man and others",
   "venue": "IEEE Symposium on Security and Privacy (S&P)",
   "year": "2025",
   "url": "",
   "bibkey": "man2025scad"
  },
  {
   "system": "CPG",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "mem,logic",
   "focus": "",
   "automation": "",
   "techniques": [
    "Min",
    "Tnt"
   ],
   "llm": false,
   "title": "Modeling and Discovering Vulnerabilities with Code Property Graphs",
   "authors": "Fabian Yamaguchi and Nico Golde and Daniel Arp and Konrad Rieck",
   "venue": "IEEE Symposium on Security and Privacy (S&P)",
   "year": "2014",
   "url": "",
   "bibkey": "yamaguchi2014modeling"
  },
  {
   "system": "Coccinelle",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "logic",
   "focus": "",
   "automation": "",
   "techniques": [
    "Min"
   ],
   "llm": false,
   "title": "Coccinelle: 10 Years of Automated Evolution in the Linux Kernel",
   "authors": "Julia Lawall and Gilles Muller",
   "venue": "USENIX Annual Technical Conference",
   "year": "2018",
   "url": "",
   "bibkey": "coccinelle"
  },
  {
   "system": "KNighter",
   "stage": "S1",
   "stageName": "Discovery",
   "group": "Static and hybrid discovery",
   "type": "Static",
   "target": "generic",
   "bugClass": "logic",
   "focus": "",
   "automation": "",
   "techniques": [
    "Min",
    "ML",
    "Sym"
   ],
   "llm": true,
   "title": "KNighter: Transforming Static Analysis with LLM-Synthesized Checkers",
   "authors": "Chenyuan Yang and Zijie Zhao and Zichen Xie and Haoyu Li and Lingming Zhang",
   "venue": "ACM SIGOPS Symposium on Operating Systems Principles",
   "year": "2025",
   "url": "",
   "bibkey": "knighter"
  },
  {
   "system": "SyzScope",
   "stage": "S2",
   "stageName": "Triage",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "impact re-rank",
   "userSpace": false,
   "automation": "A1",
   "techniques": [],
   "llm": false,
   "title": "SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux Kernel",
   "authors": "Xiaochen Zou and Guoren Li and Weiteng Chen and Hang Zhang and Zhiyun Qian",
   "venue": "USENIX Security Symposium",
   "year": "2022",
   "url": "",
   "bibkey": "syzscope"
  },
  {
   "system": "LLM triage",
   "stage": "S2",
   "stageName": "Triage",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "severity",
   "userSpace": false,
   "automation": "A1",
   "techniques": [],
   "llm": true,
   "title": "Streamlining Security Vulnerability Triage with Large Language Models",
   "authors": "Mohammad Jalili Torkamani and others",
   "venue": "arXiv",
   "year": "2025",
   "url": "https://arxiv.org/abs/2501.18908",
   "bibkey": "llmtriage"
  },
  {
   "system": "GREBE",
   "stage": "S2",
   "stageName": "Triage",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "exploitability",
   "userSpace": false,
   "automation": "A1",
   "techniques": [],
   "llm": false,
   "title": "GREBE: Unveiling Exploitation Potential for Linux Kernel Bugs",
   "authors": "Zhenpeng Lin and others",
   "venue": "IEEE Symposium on Security and Privacy (S&P)",
   "year": "2022",
   "url": "",
   "bibkey": "grebe"
  },
  {
   "system": "AURORA",
   "stage": "S2",
   "stageName": "Triage",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "root cause",
   "userSpace": false,
   "automation": "A1",
   "techniques": [],
   "llm": false,
   "title": "AURORA: Statistical Crash Analysis for Automated Root Cause Explanation",
   "authors": "Tim Blazytko and others",
   "venue": "USENIX Security Symposium",
   "year": "2020",
   "url": "",
   "bibkey": "aurora"
  },
  {
   "system": "ARCUS",
   "stage": "S2",
   "stageName": "Triage",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "root cause",
   "userSpace": false,
   "automation": "A1",
   "techniques": [],
   "llm": false,
   "title": "ARCUS: Symbolic Root Cause Analysis of Exploits in Production Systems",
   "authors": "Carter Yagemann and others",
   "venue": "USENIX Security Symposium",
   "year": "2021",
   "url": "",
   "bibkey": "arcus"
  },
  {
   "system": "CrashFixer",
   "stage": "S3",
   "stageName": "Generation",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "LLM agent",
   "userSpace": false,
   "automation": "A1",
   "techniques": [],
   "llm": true,
   "title": "CrashFixer: A Crash Resolution Agent for the Linux Kernel",
   "authors": "Alex Mathai and Chenxi Huang and Suwei Ma and Jihwan Kim and Hailie Mitchell and Aleksandr Nogikh and Petros Maniatis and Franjo Ivan\\vcic and Junfeng Yang and Baishakhi Ray",
   "venue": "arXiv",
   "year": "2025",
   "url": "https://arxiv.org/abs/2504.20412",
   "bibkey": "crashfixer"
  },
  {
   "system": "PatchIsland",
   "stage": "S3",
   "stageName": "Generation",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "LLM agent",
   "userSpace": false,
   "automation": "A1",
   "techniques": [],
   "llm": true,
   "title": "PatchIsland: Orchestration of LLM Agents for Continuous Vulnerability Repair",
   "authors": "Wonyoung Kim and others",
   "venue": "arXiv",
   "year": "2026",
   "url": "https://arxiv.org/abs/2601.17471",
   "bibkey": "patchisland"
  },
  {
   "system": "kGym/kBench",
   "stage": "S3",
   "stageName": "Generation",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "platform",
   "userSpace": false,
   "automation": "A1",
   "techniques": [],
   "llm": true,
   "title": "kGym: A Platform and Dataset to Benchmark Large Language Models on Linux Kernel Crash Resolution",
   "authors": "Alex Mathai and Chenxi Huang and Petros Maniatis and Aleksandr Nogikh and Franjo Ivan\\vcic and Junfeng Yang and Baishakhi Ray",
   "venue": "Conference on Neural Information Processing Systems, Datasets and Benchmarks Track (NeurIPS)",
   "year": "2024",
   "url": "",
   "bibkey": "kgym"
  },
  {
   "system": "Coccinelle",
   "stage": "S3",
   "stageName": "Generation",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "semantic",
   "userSpace": false,
   "automation": "A0",
   "techniques": [],
   "llm": false,
   "title": "Coccinelle: 10 Years of Automated Evolution in the Linux Kernel",
   "authors": "Julia Lawall and Gilles Muller",
   "venue": "USENIX Annual Technical Conference",
   "year": "2018",
   "url": "",
   "bibkey": "coccinelle"
  },
  {
   "system": "FixMorph",
   "stage": "S3",
   "stageName": "Generation",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "backport",
   "userSpace": false,
   "automation": "A1",
   "techniques": [],
   "llm": false,
   "title": "Automated Patch Backporting in Linux (Experience Paper)",
   "authors": "Ridwan Shariffdeen and others",
   "venue": "ACM SIGSOFT International Symposium on Software Testing and Analysis",
   "year": "2021",
   "url": "",
   "bibkey": "fixmorph"
  },
  {
   "system": "PatchNet",
   "stage": "S3",
   "stageName": "Generation",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "backport sel.",
   "userSpace": false,
   "automation": "A1",
   "techniques": [],
   "llm": false,
   "title": "PatchNet: Hierarchical Deep Learning-Based Stable Patch Identification for the Linux Kernel",
   "authors": "Thong Hoang and Julia Lawall and Yuan Tian and Richard J. Oentaryo and David Lo",
   "venue": "IEEE Transactions on Software Engineering",
   "year": "2021",
   "url": "",
   "bibkey": "patchnet"
  },
  {
   "system": "KLAUS",
   "stage": "S4",
   "stageName": "Validation",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "correctness",
   "userSpace": false,
   "automation": "H",
   "techniques": [],
   "llm": false,
   "title": "Mitigating Security Risks in Linux with KLAUS: A Method for Evaluating Patch Correctness",
   "authors": "Yuhang Wu and others",
   "venue": "USENIX Security Symposium",
   "year": "2023",
   "url": "",
   "bibkey": "klaus"
  },
  {
   "system": "LLM-judge",
   "stage": "S4",
   "stageName": "Validation",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "correctness",
   "userSpace": true,
   "automation": "H",
   "techniques": [],
   "llm": true,
   "title": "Towards a Human-in-the-Loop Framework for Reliable Patch Evaluation Using an LLM-as-a-Judge",
   "authors": "Sherry Shi and Renyao Wei and Michele Tufano and Jose Cambronero and Runxiang Cheng and Franjo Ivan\\vcic and Pat Rondon",
   "venue": "arXiv",
   "year": "2025",
   "url": "https://arxiv.org/abs/2511.10865",
   "bibkey": "llmjudge"
  },
  {
   "system": "Incomplete-fix",
   "stage": "S4",
   "stageName": "Validation",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "completeness",
   "userSpace": false,
   "automation": "A1",
   "techniques": [],
   "llm": false,
   "title": "Characteristics, Root Causes, and Detection of Incomplete Security Bug Fixes in the Linux Kernel",
   "authors": "Qiang Liu and Wenlong Zhang and Muhui Jiang and Lei Wu and Yajin Zhou",
   "venue": "arXiv",
   "year": "2025",
   "url": "https://arxiv.org/abs/2511.17799",
   "bibkey": "incompletefix"
  },
  {
   "system": "PDiff",
   "stage": "S4",
   "stageName": "Validation",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "presence",
   "userSpace": false,
   "automation": "A1",
   "techniques": [],
   "llm": false,
   "title": "PDiff: Semantic-based Patch Presence Testing for Downstream Kernels",
   "authors": "Zheyue Jiang and others",
   "venue": "ACM SIGSAC Conference on Computer and Communications Security",
   "year": "2020",
   "url": "",
   "bibkey": "pdiff"
  },
  {
   "system": "CodeReviewer",
   "stage": "S5",
   "stageName": "Integration",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "review autom.",
   "userSpace": false,
   "automation": "A1",
   "techniques": [],
   "llm": true,
   "title": "Automating Code Review Activities by Large-Scale Pre-training",
   "authors": "Zhiyu Li and others",
   "venue": "ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE)",
   "year": "2022",
   "url": "",
   "bibkey": "codereviewer"
  },
  {
   "system": "Zhou et al.",
   "stage": "S5",
   "stageName": "Integration",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "maintainer load",
   "userSpace": false,
   "automation": "M",
   "techniques": [],
   "llm": false,
   "title": "On the Scalability of Linux Kernel Maintainers' Work",
   "authors": "Minghui Zhou and Qingying Chen and Audris Mockus and Fengguang Wu",
   "venue": "ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE)",
   "year": "2017",
   "url": "",
   "bibkey": "zhou2017"
  },
  {
   "system": "Rust-for-Linux",
   "stage": "S5",
   "stageName": "Integration",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "reviewer scarce",
   "userSpace": false,
   "automation": "M",
   "techniques": [],
   "llm": false,
   "title": "An Empirical Study of Rust-for-Linux: The Success, Dissatisfaction, and Compromise",
   "authors": "Hongyu Li and Liwei Guo and Yexuan Yang and Shangguang Wang and Mengwei Xu",
   "venue": "USENIX Annual Technical Conference",
   "year": "2024",
   "url": "",
   "bibkey": "rust4linux"
  },
  {
   "system": "Patch-Me",
   "stage": "S5",
   "stageName": "Integration",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "CVE flood",
   "userSpace": false,
   "automation": "M",
   "techniques": [],
   "llm": false,
   "title": "Patch Me If You Can–-Securing the Linux Kernel",
   "authors": "Gunnar Kudrjavets",
   "venue": "IEEE/ACM International Conference on Mining Software Repositories (MSR)",
   "year": "2025",
   "url": "",
   "bibkey": "patchmeifyoucan"
  },
  {
   "system": "Jiang et al.",
   "stage": "S5",
   "stageName": "Integration",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "acceptance",
   "userSpace": false,
   "automation": "M",
   "techniques": [],
   "llm": false,
   "title": "Will My Patch Make It? And How Fast? Case Study on the Linux Kernel",
   "authors": "Yujuan Jiang and Bram Adams and Daniel M. German",
   "venue": "IEEE/ACM International Conference on Mining Software Repositories (MSR)",
   "year": "2013",
   "url": "",
   "bibkey": "jiang2013"
  },
  {
   "system": "Patchwork",
   "stage": "S5",
   "stageName": "Integration",
   "group": "",
   "type": "",
   "target": "",
   "bugClass": "",
   "focus": "dataset",
   "userSpace": false,
   "automation": "M",
   "techniques": [],
   "llm": false,
   "title": "A Multi-level Dataset of Linux Kernel Patchwork",
   "authors": "Yulin Xu and Minghui Zhou",
   "venue": "IEEE/ACM International Conference on Mining Software Repositories (MSR)",
   "year": "2018",
   "url": "",
   "bibkey": "patchwork"
  }
 ]
}