Fine-Grained Kernel Memory Isolation Using Hardware Protection Keys and Capability Mapping

Abstract

Hardware protection keys (PKU/PKS) offer lightweight mechanisms for runtime memory access control, yet prior systems often apply them at coarse granularity. We introduce a capability-mapped isolation framework that partitions kernel subsystems into fine-grained memory regions with adaptive key assignments. Tested on Linux 6.1, the system enforces per-function memory boundaries with <3.5% performance overhead, blocking 94% of simulated invalid-write attacks. Stress tests using 22 historical CVE exploits demonstrate complete mitigation in 18 cases. Our results show that combining capability mapping with PKS significantly strengthens kernel memory integrity while remaining deployment-friendly.