syzkaller

Visit Website

Introduction

syzkaller is an unsupervised, coverage-guided kernel fuzzer. Supported operating systems include FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD and Windows, and the README lists bugs found in Darwin/XNU, FreeBSD, Linux, NetBSD, OpenBSD and Windows.

It generates system call programs from syscall descriptions, runs them in virtual machines, and uses kernel code coverage to guide mutation, with tooling for reproducing crashes. Google’s syzbot service runs it continuously against kernels.

In the quality loop syzkaller is the standard tool for kernel security fuzzing.

The source code is at google/syzkaller on GitHub under the Apache-2.0 licence, with about 6,400 stars; the most recent commit was on 11 November 2026.

Features

1. Syscall descriptions: Model kernel interfaces.
2. Coverage-guided: Kernel coverage feedback.
3. VM orchestration: Runs many test VMs.
4. Crash reproduction: Tools to reproduce crashes.
5. Multi-OS: Several kernels supported.
6. Manager process: syz-manager runs the campaign.

Pros

1. Proven results: The README lists bugs found in six kernels.
2. Free to use: Open source under the Apache-2.0 licence, so the core tool costs nothing to use.
3. Actively maintained: The repository had commits as recent as 11 November 2026.
4. Community: About 6,400 GitHub stars.

Cons

1. Complex setup: Kernel builds and VMs.
2. Linux-centric docs: Most docs target Linux.
3. Heavy resources: Needs many CPU cores.

Usage and Links (Example)

make
./bin/syz-manager -config=my.cfg

Resources:

• syzkaller website

Pricing

syzkaller is free and open source under the Apache-2.0 licence.

Recommended for?

1. Kernel and driver developers.

Conclusion

syzkaller is essential for anyone shipping kernel code.

Start from syzbot’s configurations.

On CheckOps, syzkaller is filed under the Security testing stage. Related tools listed here include libFuzzer, AFL++, honggfuzz, LibAFL, OSS-Fuzz and ClusterFuzzLite. A short trial on a real project, with your own code, data and pipeline, is usually the fastest way to choose between them, because fit matters more than feature lists. Facts here come from the official site, documentation and repository, checked on 11 November 2026.