Full-time on Linux internals, reverse engineering and vulnerability research since January 2026. Everything below is from this year.

Applied by Linus Torvalds A fix for an mt792x crash that left laptops without Wi-Fi, pulled straight off the mailing list into mainline.	CVE-2026-20161, credited by Cisco The ThousandEyes Enterprise Agent let a low-privileged local user overwrite any file on the machine.
32 patches in mainline Linux Fixes in the mt76 (MediaTek), rtw89 (Realtek) and mac80211 Wi-Fi code. Thirteen landed in the 7.4 merge window, and three more are queued.	Working with MediaTek and Realtek Patches co-developed with MediaTek engineers, and rtw89 fixes acked by Realtek's maintainer.
Open firmware for the AIC8800 Clean-room firmware for the AICSemi AIC8800 USB Wi-Fi chip. Two carriers commanded 66 MHz apart landed 66.01 MHz apart, each within 20 kHz.	Available for remote contracts Linux Wi-Fi and USB driver development, firmware and protocol reverse engineering, vulnerability research.

📍 Vancouver Island, BC, Canada  ·  ✉️ lucid_duck@justthetip.ca  ·  🌐 justthetip.ca  ·  ☕ Ko-fi

Of the thirty-two in mainline, twelve carry a stable tag. Nine have shipped in the stable trees, across eight branches back to 5.10. The oldest bug fixed dates to 2017.

The kernel has assigned CVEs to seven of these fixes: CVE-2026-68193, CVE-2026-68194, CVE-2026-68195, CVE-2026-80825, CVE-2026-80936, CVE-2026-90382 and CVE-2026-98182. Each is linked under its commit in the table below.

Most of them share a cause. USB and SDIO adapters, and monitor mode, run through code written and tested mainly for PCIe cards doing ordinary client traffic.

Fourteen more mainline commits credit me for reporting, testing or carrying them upstream.

Outside wireless, two fixes to the DRM panic screen are queued for mainline. A log line too long for its buffer left the screen looping forever, so the panic never finished, and setting the screen mode with echo failed on the trailing newline.

Write and triage collaborator on three of morrownr's repos. Review, tester coordination, and the link between them, linux-wireless and upstream.

• USB-WiFi: adapter reviews, a list of what actually works on Linux, chipset tables and user support. I'm listed as one of its two site maintainers.
• mt76: out-of-tree builds of the mt76 driver for kernels 6.12 through 7.4, so people get current fixes without waiting on a distro. The install scripts handle DKMS and Secure Boot.
• rtw89: the same job for the rtw89 series, writing and testing USB drivers with the aim of getting them upstream.

This USB Wi-Fi family has no mainline support. The vendor's own driver was told upstream to be redesigned from scratch first, and the licence on its firmware is still unresolved. So I'm writing a replacement: open firmware on the chip, the standard Linux stack on the host, no vendor blob.

reverse engineered   boot and init, the USB data path, the transmit and receive
                     rings, firmware load, and the calibration that nulls carrier
                     leakage. From the disassembly, with no source and no datasheet
on air               the new firmware, running standalone, programs the synthesiser
                     and puts a narrow CW carrier where it is commanded. Two targets
                     66 MHz apart landed 66.01 MHz apart, each within 20 kHz, and
                     every peak vanishes with the chip powered down
next                 frames

Automotive keyless entry, 2026. A dozen firmware images for a hardware-security vendor, delivered and in flight. Each delivery is a C reimplementation of that firmware's cryptography and key derivation, checked byte for byte against captured radio traffic or against an emulator.

cores      STM8, ARM Cortex-M0, PIC, HCS12 and HCS12X, V850, R32C, 8051
ciphers    KeeLoq variants, XTEA, AES-128, a DST80-family stream cipher,
           custom block and S-box designs, several PRNGs

The hard part was getting from a stripped flash dump to a function map. Stock tooling gave up on paged flash and the uncommon cores, so I wrote a function walker, disassembler and emulator for it.

Linux wireless driver, current. Driver work for a module vendor so their USB part can carry long-range video links. Fixed-rate injection, narrow channels, and getting the result upstream.

Reported through Bugcrowd and HackerOne. Vendor names are withheld where an embargo or agreement applies.

• First CVE, arbitrary file overwrite as root. CVE-2026-20161 (Cisco ThousandEyes). A monitoring agent running as root followed a symlink out of its own log directory, so a local user with low privileges could overwrite any file on the box. Fixed in 1.234.0.

_{justthetip.ca: the writing, and every machine and radio on the lab bench.}