A Comprehensive Study of Concurrency Bugs in the Linux Kernel

Concurrency bugs arise from unexpected orderings of concurrent instructions and are notoriously difficult to detect and diagnose due to their non-deterministic nature. Prior studies of concurrency bugs in user-space applications have identified common bug characteristics and informed the design of effective detection, diagnosis, and repair techniques. In contrast, far less is known about concurrency bugs in operating system kernels, where low-level systems programming and complex execution patterns introduce fundamentally different concurrent execution behaviors.

This paper presents the first comprehensive study of concurrency bugs in the Linux kernel. We analyze 200 real-world kernel concurrency bugs and systematically characterize their manifestation conditions, root causes, discovery processes, and repair characteristics. Our study reveals that kernel concurrency bugs differ substantially from their user-space counterparts. For instance, 27.5% of kernel concurrency bugs manifest only when specific interrupt events occur, yet such bugs are often overlooked by existing bug discovery approaches. Moreover, nearly half of the bugs occur in kernel drivers, and 69.3% of them stem from concurrent device operations on control paths such as device registration and deregistration, highlighting driver control logic as a critical target for concurrency bug discovery. Overall, our findings expose key limitations in current approaches to kernel concurrency bug detection and analysis. By shedding light on these challenges, this work paves the way for new operating system designs, testing tools, and verification efforts that will make modern operating systems more reliable and secure.