Defeating KASLR by Doing Nothing at All

This research details how the Linux kernel linear mapping on arm64 is not randomized and how Pixel devices load the kernel at a static physical address, enabling deterministic calculation of kernel virtual addresses. Using a privileged arbitrary-read primitive and knowledge of PHYS_OFFSET and fixed kernel physical offsets, an attacker can derive stable kernel addresses and leverage the linear map (which exposes kernel.data regions as read-write) to place controlled data at known kernel addresses. The report demonstrates practical reliability for placing attacker-controlled pages, discusses impact on exploitation (notably easier arbitrary kernel read/write and forged kernel objects), and recommends increasing entropy in physical allocation, randomizing the linear map and kernel physical load locations to mitigate the issue.