Control-Flow–Aware Kernel Compartmentalization for Preventing Intra-Subsystem Escalation

Abstract

We propose a control-flow–aware partitioning model that clusters kernel functions based on CFG similarity and call-chain trust levels. Coupled with PKS-based domain enforcement, this model prevents compromised subsystems (e.g., netfilter or VFS) from escalating privileges through legitimate control-flow edges. On Linux 5.15, our approach blocks 83% of cross-subsystem attack chains** and reduces gadget availability for ROP-style attacks by 45%. The system introduces only 2.8% runtime overhead under standard kernel workloads. This demonstrates that integrating control-flow semantics into compartment design yields better blast-radius reduction.