ExpLinux: Reproducible Linux kernel exploit labs from public CVE disclosures

Public proof-of-concept exploits for Linux kernel privilege-escalation vulnerabilities often depend on undocumented environmental assumptions, limiting their reproducibility. This paper presents ExpLinux , a methodology and framework for converting public vulnerability artifacts into reproducible, mitigation-aware exploitation labs. A five-stage process (import, assess, develop, harden, and promote) combines scripted tools with a large language model agent that assesses and ports public exploits under human supervision. Each lab pins its kernel image and configuration, root filesystem, mitigation profile, and required modules. Replay checks and author verification assess the resulting artifact. Three reproducibility contracts distinguish repeated bug effects, stable serial-log digests, and a scripted build procedure with a recorded trigger observation. A seven-category taxonomy organizes exploitation primitives and supports the agent’s knowledge base. The evaluation includes ten validated labs and one scaffolded lab across kernel versions 5.15–6.18. Selected replay experiments show identical bug-effect bytes despite environmental log variation; a minimal-initrd lab produces a stable log digest, while an exploit with a post-success kernel panic is assessed under the build-procedure contract. Retrospective estimates for five validated labs range from 2.4 to 29.5 h, with porting accounting for most of the effort. An offline classification maps 24 of 30 public Linux privilege-escalation vulnerabilities from 2018–2024 to the original six taxonomy categories. A controlled fuzzing demonstration also produces two version-pinned labs. These results support explicit environment pinning and lab-specific validation as a practical basis for reproducible vulnerability research.