--- title: Using syzkaller, part 2: Detecting programming bugs in... description: A hands-on setup guide for syzkaller, Google's kernel fuzzer, covering all steps needed to start finding real bugs in the Linux kernel. Topics include required... canonical: https://daily.dev/posts/using-syzkaller-part-2-detecting-programming-bugs-in-the-linux-kernel-u8tqfecin twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Using syzkaller, part 2: Detecting programming bugs in the Linux kernel | daily.dev og:description: A hands-on setup guide for syzkaller, Google's kernel fuzzer, covering all steps needed to start finding real bugs in the Linux kernel. Topics include required... og:url: https://daily.dev/posts/using-syzkaller-part-2-detecting-programming-bugs-in-the-linux-kernel-u8tqfecin og:image: https://api.daily.dev/og/posts/U8TQfecIn.png og:image:alt: Using syzkaller, part 2: Detecting programming bugs in the Linux kernel og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Using syzkaller, part 2: Detecting programming bugs in the Linux kernel **[Collabora Blog](https://daily.dev/sources/collabora)** · 8 min read · 0 upvotes · 0 comments ## Summary A hands-on setup guide for syzkaller, Google's kernel fuzzer, covering all steps needed to start finding real bugs in the Linux kernel. Topics include required kernel config options (KCOV, KASAN, DEBUG_INFO), building a Debian-based rootfs with QEMU, installing the Go toolchain and syzkaller, creating a configuration file with key parameters (target, procs, VM count, image), launching syz-manager, and navigating the web dashboard for coverage reports and crash analysis. The post also explains how to scope fuzzing to specific syscalls using enable_syscalls and disable_syscalls options. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What kernel config options are required to run syzkaller for Linux kernel fuzzing? The minimum required kernel configs for syzkaller are CONFIG_KCOV=y, CONFIG_KCOV_INSTRUMENT_ALL=y, CONFIG_KCOV_ENABLE_COMPARISONS=y, CONFIG_DEBUG_FS=y, CONFIG_CONFIGFS_FS=y, and CONFIG_SECURITYFS=y. CONFIG_DEBUG_INFO must also be enabled to navigate code coverage in the web interface. Enabling KASAN on top of these is strongly recommended to maximize bug detection. _Kernel developers tracking syzkaller setup requirements and config changes find relevant updates on daily.dev._ ### How do I limit syzkaller to fuzz only specific syscalls instead of all of them? Add an "enable_syscalls" list to your syzkaller config.cfg to fuzz only those syscalls. For example, specifying "read$eventfd" targets only the eventfd variant, while "read" triggers all definitions for that syscall family. Conversely, "disable_syscalls" lets you fuzz everything except the listed entries. Both options can be placed anywhere in the config file outside the vm block. _Teams scoping kernel fuzzing campaigns to specific subsystems keep up with syzkaller patterns on daily.dev._ ### How do I create a rootfs image for syzkaller QEMU virtual machines? Syzkaller ships a script at tools/create-image.sh that builds a minimal Debian rootfs using the debootstrap package. Run it with the desired output directory set as the working directory. The resulting image includes necessary tools and an SSH server, which syzkaller uses to copy files and execute commands across the spawned VMs. Pass -h to explore additional options. _Developers building Linux kernel test environments find practical setup guides like this on daily.dev._ ## Similar posts on daily.dev - [Poison, redzones and shadows: inside KASAN – Bootlin](https://daily.dev/posts/poison-redzones-and-shadows-inside-kasan-bootlin-hgaakzhee) · Bootlin · 0 upvotes · 0 comments - [dfir.ch](https://daily.dev/posts/dfir-ch-4bungjgrb) · dfir.ch · 0 upvotes · 0 comments - [Linux Kernel Introducing New Taint Due To Fuzzing Bots Yielding Impractical Bug Reports](https://daily.dev/posts/linux-kernel-introducing-new-taint-due-to-fuzzing-bots-yielding-impractical-bug-reports-xgx8vvj7q) · Phoronix · 0 upvotes · 0 comments - [FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs \(Part 1 of 2\)](https://daily.dev/posts/freebsod-leveraging-language-models-to-find-and-exploit-kernel-bugs-part-1-of-2--sijy0aoxi) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/using-syzkaller-part-2-detecting-programming-bugs-in-the-linux-kernel-u8tqfecin) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Using syzkaller, part 2: Detecting programming bugs in the Linux kernel","url":"https://daily.dev/posts/using-syzkaller-part-2-detecting-programming-bugs-in-the-linux-kernel-u8tqfecin","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/using-syzkaller-part-2-detecting-programming-bugs-in-the-linux-kernel-u8tqfecin"},"datePublished":"2026-08-11T08:57:17.643Z","dateModified":"2026-08-11T09:14:54.391Z","description":"A hands-on setup guide for syzkaller, Google's kernel fuzzer, covering all steps needed to start finding real bugs in the Linux kernel. Topics include required...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3639f9e1cad69d1d1223d91738f0489a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3639f9e1cad69d1d1223d91738f0489a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collabora Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collabora Blog","logo":"https://media.daily.dev/image/upload/s--ZGZ0FjqS--/f_auto,q_auto/v1786438306/logos/collabora?_a=BAMAMicg0","url":"https://daily.dev/sources/collabora"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/using-syzkaller-part-2-detecting-programming-bugs-in-the-linux-kernel-u8tqfecin","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collabora Blog","item":"https://daily.dev/sources/collabora"},{"@type":"ListItem","position":3,"name":"Using syzkaller, part 2: Detecting programming bugs in the Linux kernel"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/using-syzkaller-part-2-detecting-programming-bugs-in-the-linux-kernel-u8tqfecin#faq","mainEntity":[{"@type":"Question","name":"What kernel config options are required to run syzkaller for Linux kernel fuzzing?","acceptedAnswer":{"@type":"Answer","text":"The minimum required kernel configs for syzkaller are CONFIG_KCOV=y, CONFIG_KCOV_INSTRUMENT_ALL=y, CONFIG_KCOV_ENABLE_COMPARISONS=y, CONFIG_DEBUG_FS=y, CONFIG_CONFIGFS_FS=y, and CONFIG_SECURITYFS=y. CONFIG_DEBUG_INFO must also be enabled to navigate code coverage in the web interface. Enabling KASAN on top of these is strongly recommended to maximize bug detection. Kernel developers tracking syzkaller setup requirements and config changes find relevant updates on daily.dev."}},{"@type":"Question","name":"How do I limit syzkaller to fuzz only specific syscalls instead of all of them?","acceptedAnswer":{"@type":"Answer","text":"Add an \"enable_syscalls\" list to your syzkaller config.cfg to fuzz only those syscalls. For example, specifying \"read$eventfd\" targets only the eventfd variant, while \"read\" triggers all definitions for that syscall family. Conversely, \"disable_syscalls\" lets you fuzz everything except the listed entries. Both options can be placed anywhere in the config file outside the vm block. Teams scoping kernel fuzzing campaigns to specific subsystems keep up with syzkaller patterns on daily.dev."}},{"@type":"Question","name":"How do I create a rootfs image for syzkaller QEMU virtual machines?","acceptedAnswer":{"@type":"Answer","text":"Syzkaller ships a script at tools/create-image.sh that builds a minimal Debian rootfs using the debootstrap package. Run it with the desired output directory set as the working directory. The resulting image includes necessary tools and an SSH server, which syzkaller uses to copy files and execute commands across the spawned VMs. Pass -h to explore additional options. Developers building Linux kernel test environments find practical setup guides like this on daily.dev."}}]} ```