Session
This talk presents a semantic variant-hunting workflow that produced three new unprivileged root exploits, including Dirty Pedit (CVE-2026-46331), a deterministic route to root in under one second via Linux traffic control. It also introduces QuerySmith and QueryLens and outlines a practical method for decomposing exploit chains into queryable stages.