AI × Systems Security
I build AI systems and secure every layer they stand on: RAG, LLM and MCP pipelines at the top, the Linux kernel at the bottom. 6 CVEs, Linux kernel patches shipped in mainline with stable backports, and 12 findings across the MCP ecosystem.
/ 00 · Mainline
drm/hyperv, Linux kernel. Backported to the stable trees 5.15 through 7.0, Reviewed-by: Michael Kelley.
hdr_size = sizeof(struct pipe_msg_hdr) + sizeof(struct synthvid_msg_hdr);if (bytes_recvd < hdr_size) { drm_err_ratelimited(&hv->dev, "synthvid packet too small for header: %u\n", bytes_recvd); return;}No renders, no stock. Every specimen is my own published work — kernel patches, CVEs, hardened mail. Verify each on lore.kernel.org and cve.org.
Coordinated disclosure with maintainers, MITRE, RustSec, and the Linux kernel list. Every advisory below verifiable on a public ledger: CVE record, GHSA permalink, RustSec PR, or lore.kernel.org thread.
Scoped server-side prototype pollution in tada5hi/smob's
merge / assign via a computed __proto__ key.
Same family as CVE-2022-24802 (deepmerge-ts) and CVE-2024-38986 (@75lb/deep-merge).
Patched in 1.6.2 by maintainer Peter Placzek (PR #446).
Issued by GitHub-CNA, reporter credit on berkant-koc. Advisory pending publish-click.
Reported to the Bytecode Alliance security contact and, at their request, filed as a private GitHub security advisory. In maintainer triage since May 2026, no CVE assigned yet. Technical details stay private until a fix ships, per coordinated disclosure.
Out-of-bounds write in drivers/gpu/drm/qxl/qxl_ioctl.c:
apply_reloc and apply_surf_reloc wrote a user-controlled
dst_offset without bounds-checking against the BO size.
13-year-old aspirational comment from v3.10 ("dst must be validated") never implemented.
Guest-local OOB-write in QXL VRAM, plausible priming primitive for guest-to-host escape.
Format-correction guided by Willy Tarreau. Waiting on maintainer Gerd Hoffmann ACK.
/*
* dst must be validated, i.e. whole bo on vram/surfacesram.
* Refuse offsets that would write past the end of the BO,
* or where dst_offset + write_size would overflow uint32_t.
*/
+if (reloc_info[i].type == QXL_RELOC_TYPE_BO &&
+ (reloc_info[i].dst_offset > U32_MAX - sizeof(uint64_t) ||
+ reloc_info[i].dst_offset + sizeof(uint64_t) >
+ reloc_info[i].dst_bo->tbo.base.size)) {
+ ret = -EINVAL;
+ goto out_free_bos;
+}
+if (reloc_info[i].type == QXL_RELOC_TYPE_SURF &&
+ (reloc_info[i].dst_offset > U32_MAX - sizeof(uint32_t) ||
+ reloc_info[i].dst_offset + sizeof(uint32_t) >
+ reloc_info[i].dst_bo->tbo.base.size)) {
+ ret = -EINVAL;
+ goto out_free_bos;
+}From: Berkant Koc <me@berkoc.com>
To: Gerd Hoffmann <kraxel@redhat.com>,
Dave Airlie <airlied@redhat.com>
Cc: virtualization@lists.linux.dev,
dri-devel@lists.freedesktop.org,
spice-devel@lists.freedesktop.org
Subject: [PATCH] drm/qxl: validate dst_offset in apply_reloc
against BO size
Date: Wed, 14 May 2026 12:07:40 +0200 (CEST)
Unsound mem::transmute in Sender::send on the
unbounded-spsc Rust crate. Coordinated with maintainer Shane Pearman;
GHSA published 2026-05-18, CVE-2026-46690 issued by GitHub CNA same day.
Adjacent oneringbuf finding merged in
RustSec PR #2883
after upstream-fix-first etiquette.
EntryPoint::FromStr in rattler_conda_types trims but does not
sanitize the entry-point name, so a malicious noarch:python package can
write executables outside the install prefix (arbitrary file write).
Coordinated with maintainer Bas Zalmstra; advisory GHSA-q53q-5r4j-5729 accepted
2026-05-19, CVE-2026-47425 issued by GitHub CNA the same day.
Advisories from the 2026-05-14 disclosure sprint sitting in maintainer triage windows.
Includes youki readonly_paths bypass (Toru Komatsu, PoC ETA),
oneringbuf Box-drop (RustSec PR #2883 merged via dirkjan),
and submissions to SGLang, LightLLM, LMDeploy,
OpenHands, Outline, ESPHome, conda,
rattler, PDM.
For the up-to-date list, see the live ledger.
Vulnerability research and coordinated disclosure across npm, Rust crates.io, the Bytecode Alliance WebAssembly runtime, and the Linux kernel. Full advisory list with public-ledger links in the Research section.
Back for the 2026 season.
Code reviews on Java assignments (JUnit · State Pattern · Dependency Injection · Maven). Individual feedback to students, in-person support during lab sessions. Guidance through the Scrum project phase with Git, Jenkins, Redmine.
Working student with research tasks in software development and data science at an AI and data-engineering consultancy on Lake Constance. Regulatory and market research, delivered as written research documentation.
Sales role, not engineering. Used AI tools to cut analysis tasks from several weeks to a few hours. Built a SharePoint hub as the sales team's central entry point and brought scattered data into one place. Kept the critical parts list weekly during a semiconductor shortage and spotted a delivery discrepancy early enough for a timely escalation. Side initiative: concept for an automated sales assistant with the natural language processing department, and an exchange between sales and development.
Software Engineering · Java · SQL · Cloud · IoT. Bachelor thesis in IT-security research.
Six seasons across Animation, Events, Retail, and Logistics. Seasonal team lead during peak-traffic weekends and school holidays: shift planning, on-the-floor problem-solving, customer-facing.
Comprehensive overview of the vehicle series of one of the world's largest car makers: platform data, production cycles, sensor variants and competitor information in one place. Became the central reference document in sales; results presented to an international group of project managers.
Template for change requests with built-in calculations for cost and time impact, plus a systematic comparison of general terms and conditions in quoting for new business.
Weekly upkeep of the critical parts list during a semiconductor shortage, the steering tool for cross-department crisis management: data consolidated from different sources, coverage calculated with a traffic-light logic. Spotted a delivery discrepancy early enough for a timely escalation.
This site. Vanilla TypeScript + Vite + GSAP + Lenis. No framework. Canvas 2D signal field, custom type system.
Astro static site plus a full mail-stack hardening for four domains. MTA-STS enforce, strict CAA, DNSSEC EdDSA.
Bachelor thesis comparing two commercial USB attack platforms (Hak5 USB Rubber Ducky, Bash Bunny) with a DIY implant (Raspberry Pi Zero W running P4wnP1 A.L.O.A.). Method: a capability-coverage mapping over an inventory of 88 capabilities (85, 50 and 29 of 88 for the implant, the Bash Bunny and the Rubber Ducky) plus four demonstrations in an isolated lab monitored with Sysmon and Wireshark, with mixed outcomes. Submitted July 2026, colloquium 30 September 2026.
DKIM RSA-2048 · SPF strict · MTA-STS enforce · strict CAA · DNSSEC EdDSA. Live on four domains.
A side initiative during a sales internship: concept for an automated sales assistant, including requirements analysis and alignment with the natural language processing department. Also identified the company-wide AI contact person and started an exchange between sales and development.
The form on this page is the running stack: pre-flight token, GDPR consent, AI-bait honey, three honeypot fields, confidence gate ≥3, multi-provider cascade with triple-jurisdiction (DE/CH/TR) cleanup. Zero spam across live traffic since launch.
Python+Pandas decision-support system for the TOPSIM business simulation. Sensitivity analysis with threshold-driven triggers, standardized reporting from a single source of truth. Beat the spreadsheet approach used by competing cohort groups. First place.
Public scanners run reproducible tests on berkoc.com: click any badge for a fresh run, not a cached snapshot.
CSP, HSTS, X-Frame, Referrer-Policy, COOP, CORP, SRI. Mozilla's reference scanner for web-app hardening.
Scott Helme's grader. Audits the response headers and lights up anything missing: Permissions-Policy, COEP/COOP, Reporting-API.
The industry-standard TLS audit. Cipher suites, key exchange, certificate chain, OCSP behavior, handshake simulations for every browser.
Ivan Ristić's scanner. DNSSEC, CAA, SPF, DKIM, MTA-STS, TLS, HSTS, security.txt: one report.
Dutch Internet Standards Platform, run by SIDN + ECP. Tests against modern open standards: IPv6, DNSSEC, HTTPS, security headers.
Submitted to Chromium's hard-coded HTTPS-only list. Once propagated, browsers refuse all HTTP connections to berkoc.com before a single byte is sent.
Visualises the DNSSEC chain of trust from root to RRSIG. Live cryptographic proof of EdDSA algo 15 (Ed25519), KeyTag 20637.
Twelve disclosures in the public ledger, six of them with CVE IDs, each with an OpenTimestamps proof (Bitcoin-anchored) on a PGP-clearsigned page. Manifest reproducibility verified at build time.
// DNSSEC chain of trust: should return signed answers with the AD flag
$ dig berkoc.com +dnssec +short
$ dig DS berkoc.com @1.1.1.1 +short
// Mail authentication: DKIM selectors + MTA-STS pointer
$ dig TXT 1984._domainkey.berkoc.com +short
$ dig TXT me._domainkey.berkoc.com +short
$ dig TXT _mta-sts.berkoc.com +short
// Certificate transparency: every cert ever minted for berkoc.com
$ curl -s 'https://crt.sh/?q=berkoc.com&output=json' | jq '.[].name_value'
// Web-headers: strict CSP, HSTS preload, X-Frame DENY, Permissions-Policy
$ curl -sI https://berkoc.com | grep -Ei 'strict|content-security|x-frame|referrer|permissions'
// TLS handshake: must negotiate 1.3 with AES-256-GCM and X25519
$ echo | openssl s_client -connect berkoc.com:443 -servername berkoc.com 2>/dev/null \
| openssl x509 -noout -dates -issuer -subjectB.Sc. Information Systems at RWU Ravensburg-Weingarten, completion September 2026. Seven-month internship in Sales / Key Account Management at AUMOVIO (Continental Automotive spin-off). Linux kernel patch author (drm/hyperv merged into mainline and backported to the stable trees 5.15 through 7.0; drm/qxl submitted, under review), CVE-2025-66455, CVE-2026-46435, CVE-2026-46690, CVE-2026-47425, CVE-2026-47757 and CVE-2026-53940 reporter, ten-plus GHSA submissions across the open-source ecosystem. CVP-approved researcher under Anthropic's Cyber Verification Program (May 2026).
I reply within 48 hours. Yes or no.
Mail-form below for inquiries. Channels for everything else. PGP key on request.