DMGUARD: Safeguarding Kernels from Physical-Page Use-After-Free Vulnerabilities

This artifact contains the research artifacts for the paper "DMGuard: Safeguarding Kernels from Physical-Page Use-After-Free Vulnerabilities", to appear in USENIX Security 2026. DMGuard is a runtime mitigation designed to comprehensively address physical-page use-after-free vulnerabilities across diverse translation domains, including CPU, GPU, and IOMMU page tables. It utilizes a lightweight, lockless state machine to track physical page lifecycles and detect dangling mappings. Artifact Contents: Kernel Implementation: Source code patches for integrating DMGuard into Linux kernel v6.6.0 and Mali GPU Driver r52p0 (QEMU/ARM64). Security Evaluation: Proof-of-Concept (PoC) codes for 5 real-world CVEs (covering io_uring, Mali GPU) and 5 synthetic vulnerabilities. Evaluation Scripts: Automated scripts for security evaluation and performance benchmarking (LMBench, boot time, memory overhead). Docker Environment: A fully self-contained Docker-based evaluation environment with QEMU ARM64 emulation. System Requirements: Host: x86_64 machine running Linux with Docker Engine and Docker Compose Minimum: 8GB RAM, 100GB free disk space Recommended: 16GB RAM, 8+ CPU cores (for faster kernel builds) No special hardware required (all evaluations run in QEMU emulation) Please refer to the README.md file included in the artifact for detailed instructions on environment setup, kernel compilation, and running the evaluations.