Painless intro to the Linux userland heap

This post introduces the internals of glibc’s ptmalloc2 heap on Linux—arenas, top, bins (small/large/unsorted), fastbins, binmaps, and chunk metadata—and explains allocation/freeing, coalescing, and the unlink macro, including why certain performance choices affect fragmentation and exploitation. It briefly highlights common exploitation primitives (e.g., double frees, off-by-one overwrites) and links to PoCs, serving as a foundational reference rather than a specific incident or vulnerability report.