SunnyDayBPF
What happens between a syscall returning data and a security agent interpreting it? Research into post-syscall user-buffer telemetry deception with eBPF.
INDEPENDENT SECURITY RESEARCHER
Behind the
system’s
assumptions.
I’m Azizcan Daştan. I research Linux kernel vulnerabilities, security boundaries, and the gap between what a system does and what its defenders see.
FIELD NOTES / 001TRUST BOUNDARIES
Observation ≠ reality.A boundary is only as strong as the paths that cross it.
UNDER THE SURFACELinux kerneleBPFMemory corruptionLSM / Landlockx86-64
01 / SELECTED WORK
Research.
Public investigations, disclosure records,
and experiments in progress.
LID
Linux Integrity Drift. Investigating where kernel execution paths and LSM policy enforcement diverge, with findings whose impact depends on the subsystem and configuration.
CVE-2026-7867
udisks2 authorization and privilege-boundary research. Co-discovered with Özlem Ozan; vendor record and research notes linked separately.
CVE-2026-110896
Missing authorization in WordPress Passster. Credited through Patchstack; fixed in 4.3.19. A bounded access-control finding, with no code-execution claim.
02 / ON THE WORKBENCH
Currently
exploring.
Open questions and unfinished experiments. This is where my attention is right now.
Updated
Linux kernel vulnerability research
Use-after-free, object lifetimes, and memory corruption. Following ownership and cleanup paths, especially around asynchronous io_uring operations.
LSM & Landlock boundaries
Tracing where policy is checked, how authority moves between objects, and whether alternative execution paths preserve the same restrictions.
OWL0
An x86-64 hypervisor experiment. A workbench for understanding virtualization and privilege boundaries from below the operating system.
EXPERIMENT IN PROGRESS03 / THE NOTEBOOK
Writing.
Technical deep dives, research notes,
and the occasional debugging detour.
DISCLOSURE NOTES · OCT 2026
Two CVEs, two different trust boundaries.
udisks2 authorization and Passster access control.
RESEARCH / eBPFThe event is real. Is the observation?
Inside the SunnyDayBPF research model.
RESEARCH / LINUXWhen the kernel never asks.
LID and the paths around security checks.
OFF-TOPIC / FIELD NOTEThe Costanza school of debugging.
A small reminder to question the obvious explanation.
04 / OUT IN THE WORLD
Recognition.
A few places the work has reached.
2026Accepted
DEF CON · Red Team Village
Accepted for RTV in 2026. Acceptance only; not listed as an attended event or delivered presentation.
MAY 2026Featured
eCHO News #108
SunnyDayBPF featured in the eBPF and Cilium community roundup by Bill Mulligan.
SOSP’26 eBPF Workshop · poster plan update
The poster plan was cancelled. No poster presentation or conference participation is claimed.
KEEP THE CONVERSATION GOING