arXiv subjects

Weifeng Pan

Publications and source records attributed to Weifeng Pan.

3 recordsLinked to original sources

arXiv2026

eBPF Security in the Wild: Structural Concentration, Failure Mechanisms, and Discovery Gaps

Extended Berkeley Packet Filter (eBPF) is a security-critical in-kernel execution framework, yet its vulnerability landscape remains fragmented across components, semantic gaps, and testing techniques. We present an empirical study of observed eBPF vulnerabilities. We construct a multi-source dataset from Linux kernel fixing commits, syzbot reports, and public CVE/NVD records, and analyze it through a unified framework covering structural concentration, mechanism-level failure modes, architectural distribution, and discovery gaps in representative techniques. Our results show that the observed eBPF vulnerability landscape is structurally concentrated rather than broadly dispersed across many unrelated weakness types. The dominant portion is associated with a limited set of recurring system-level failures, especially in runtime execution, concurrency, object lifecycle management, and semantic inconsistencies across trusted stages. These failures are unevenly distributed across the eBPF pipeline: Runtime is the dominant exposure surface, whereas the Verifier and JIT are lowerfrequency but structurally distinct security boundaries. A rubric-based comparison of representative techniques and a version-aligned Syzkaller case study on Linux v5.10 show that, despite visible raw coverage of Runtime, Verifier, and JIT, effective exploration is semantically narrow, and observed discoveries concentrate in a small subset of Runtime failures. Overall, raw coverage alone provides an incomplete view of discovery effectiveness.

cs.CR↗

arXiv2026

Dissecting Software Graphs: Structural Insights for Driver-Guided Fuzzing

Many software systems expose multiple execution modes through command-line options, subcommands, and configuration flags. For such programs, fuzzing depends on both mutated inputs and the invoked mode. Yet evaluations still focus on coverage and bug counts, leaving unclear how execution modes partition, overlap, and miss software structure, and how these differences affect effectiveness. We present an empirical study of software structure under multi-driver fuzzing. We propose a structural abstraction that uses a static call graph as a shared backbone and projects driver-specific dynamic coverage onto it to derive driver-induced subgraphs. Based on this abstraction, we develop a four-phase methodology for backbone construction, fuzzing and profiling, graph-based analysis, and research-question-driven evaluation. We apply it to 27 OSS-Fuzz-derived C/C++ projects, spanning 43 executables and 854 driver configurations. Under the same total budget, multi-driver fuzzing outperforms the best single-driver baseline, increasing covered call-graph nodes by 27.9% and CFG-edge coverage by 73.5%, and revealing 11 unique bugs and abnormal behaviors largely missed by single-driver fuzzing. However, driver contributions are uneven, subgraphs differ substantially in cohesion, fragmentation, modularity, overlap, and residual under-exploration follows recurring regimes rather than a homogeneous tail. These results show that multi-driver fuzzing is fundamentally a structural exploration problem.

cs.SE↗

arXiv2025

MMVU: Measuring Expert-Level Multi-Discipline Video Understanding

We introduce MMVU, a comprehensive expert-level, multi-discipline benchmark for evaluating foundation models in video understanding. MMVU includes 3,000 expert-annotated questions spanning 27 subjects across four core disciplines: Science, Healthcare, Humanities & Social Sciences, and Engineering. Compared to prior benchmarks, MMVU features three key advancements. First, it challenges models to apply domain-specific knowledge and perform expert-level reasoning to analyze specialized-domain videos, moving beyond the basic visual perception typically assessed in current video benchmarks. Second, each example is annotated by human experts from scratch. We implement strict data quality controls to ensure the high quality of the dataset. Finally, each example is enriched with expert-annotated reasoning rationals and relevant domain knowledge, facilitating in-depth analysis. We conduct an extensive evaluation of 32 frontier multimodal foundation models on MMVU. The latest System-2-capable models, o1 and Gemini 2.0 Flash Thinking, achieve the highest performance among the tested models. However, they still fall short of matching human expertise. Through in-depth error analyses and case studies, we offer actionable insights for future advancements in expert-level, knowledge-intensive video understanding for specialized domains.

cs.CV↗