kAgent用智能代理自动修复内核漏洞，准确率超65%。
kAgent: An execution-guided crash resolution agent for the Linux kernel
- 模仿开发者流程，结合执行日志生成可修复的自然语言假设。
- 在无定位情况下修复率达54.5%，有文件提示时达65%。
- 专为内核级崩溃设计，适合系统软件安全修复人员使用。
fuzzing框架如syzkaller已发现数千个Linux内核崩溃，其中许多涉及关键安全问题。然而，快速修复这些崩溃的能力未能跟上，尤其因内核代码复杂且底层特性显著。现有基于LLM的程序修复技术主要针对用户空间应用，不适用于内核模糊测试中的缺陷——例如缺乏自然语言错误报告、无完整测试断言、以及高度专业的崩溃数据。为此，我们首先识别通用智能体在复杂系统中面临的主要瓶颈。基于此，我们构建了kAgent，一种受内核开发者诊断与修复流程启发的工作流式智能体，并配套开发了kGym++工具链以支持其请求。kAgent分析相关执行日志，生成基于执行的自然语言假设，合成候选补丁，通过崩溃复现验证补丁，并迭代优化推理过程。我们对kAgent的各项智能体特性进行消融实验，定量分析其贡献。同时分享了构建内核崩溃修复智能体的实际经验。尽管本工作聚焦于Linux，但经验可推广至复杂系统软件中的模糊测试发现的漏洞。在kBenchSyz上的评估表明，无定位情况下修复率达54.5%，有正确文件提示时可达65%。此外，我们也展示了kAgent在少数真实syzkaller漏洞上的泛化能力，以及不同补丁类型对复杂系统调试者的实用价值。
原文摘要 · Abstract (English)
Fuzzing frameworks like syzkaller have uncovered thousands of Linux kernel crashes, many of which are critical and security-sensitive. However, the ability to rapidly repair these crashes has not kept pace, particularly given the complexity and low-level nature of kernel code. Predominantly targeting user-space applications, existing LLM-based program repair techniques are not tailored to the unique challenges posed by kernel fuzz bugs-such as the absence of natural language bug reports, lack of exhaustive test oracles, and highly specialized crash artifacts. Thus, in this work, we first identify the prevalent bottlenecks that generic agents struggle with in complex systems such as the Linux kernel. Guided by these findings, we then build kAgent, a workflow-based agent inspired by how kernel developers diagnose and fix bugs, and kGym++, the co-designed toolstack supporting kAgent's requests. kAgent inspects relevant execution logs, generates execution-grounded natural language hypotheses, synthesizes candidate patches, validates patches through crash reproduction, and iteratively refines its reasoning. We ablate these agentic system features in kAgent and quantitatively analyze their contributions to the overall performance. We also report our experience on building agents for kernel crash repair. Although derived from this work on Linux, we note that our experience applies broadly to fuzzing-discovered bugs in complex systems software. We evaluate kAgent on kBenchSyz and show that it can repair up to 54.5% of crashes without localization and 65% with correct file hints. We also show kAgent's generalization on a few wild Syzkaller bugs, and how different patch types offer varying utility to developers who debug complex system software.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。