By exploiting the operating system kernel, attackers can create a denial of service through either crashing the OS kernel, freezing the system or consuming all available resources rendering it unusable.
The main difference is access; local denial of service requires the ability to execute code on the target system (for example, as a logged-in user on that machine) while remote denial of service attacks come from the network without prior access.
Local denial of service are relevant to governance because they often link to privilege escalation with insider threats or after-the-fact compromised scenarios. Remote denial of service attacks are done externally to cause disruptions to internet-facing services, thereby impacting availability of server-based/cloud-based resources.
Principal differences are:
1. A local denial-of-service attack requires an original foothold into the targeted system (e.g., through a low-privileged account, a compromised process or container escape), and once the attacker executes the exploit code on that system, either a kernel panic, infinite loop or resource exhaustion can occur to the target kernel through normal or abnormal operation. Local-denial-of-service attacks are most frequently carried out in environments such as multi-user servers, shared hostings and end-user computer environments where end-users run untrusted code. Oftentimes, these types of attacks are coupled with local escalation of privilege attacks to gain root prior to and following local-denial-of-service attacks.
2. A remote denial-of-service attack is accomplished by sending specially formatted packets or requests to the attacked system over the network. No authentication or local access is needed, remote DoS attacks are completely conducted from a network perspective. In a remote DoS attack, the attacker targets kernel subsystems that are exposed to the network (e.g., TCP/IP stack, NFS/RPC services, drivers that process incoming data). Remote DoS attacks have the potential to severely disrupt publically-available Linux/Windows servers and can have the effect of taking down entire physical/virtual hosts or clusters from service.
Recent Practical Examples of Distributed Denial of Service (DDoS) Events
Local DoS Examples:
1. Linux Kernel Race Conditions/TOCTOU Bugs: Unprivileged User Triggering Kernel Timer or CPU Faults that May Result in System Hanging (or) Panicking: e.g. POSIX CPU Timer Bugs Example of Crash Due to Local Process Using Timing Race, 2025 Past Events Resulting in DDoS Via Timing Race (Shared Cloud VM Were Attack Source Has Been Through Untrusted Tenant and Trigger the Kernel Crash for All Guest Systems)
2. Windows Kernel Graphics/Driver Bugs: DDoS Attack to DirectX Graphics Kernel (CVEs associated with 2025 Patch , CVE-2025-62463 and CVE-2025-62465) When A Local Application Sends Malformed Data Used by Kernel Will Result in the Kernel Crashing (Malfunctioning) Example of Crash, Local User DoS , Local User (Malware) BSOD Loop, System Required to be Restarted Which is A Form of DDoS Due to Local Limit or Local Down Time
3. Container Escape + Local Level DDoS Event: e.g. CVE-2021-22555 (relevant in chain of events) AOSD (Exploit) Escapes from Container and Triggers Local Device Kernel DDoS Event (Example: Compromise of a Kubernetes Pod where Compromised Pod AOSD Triggers DDoS Event Against the Kernel of The Node)
Remote DoS Examples
1. Flaws in Linux' sunrpc/NFS could lead to null pointers or crashing servers due to receiving malformed RPC packets. (E.g., CVE-2025-38089).
How this works: An NFS server is exposed to the internet/intranet, an attacker sends hundreds of packets that do not conform to RFCs such as RFC 1050, and causes the server to crash while trying to process some of these malformed requests. The server remains offline until it is rebooted.
2. Local attacker (can be accessed remotely via the network) sends malformed RDMA operations that cause crashes of the RDMA subsystem which leads to DOS against a remote server (CVE-2025-68379).
How this works: An HPC cluster with RDMA exposed to the internet is attacked with malformed RDMA operations leading to disruption of compute jobs on the cluster.
3. An attacker sends malformed ICMPv6 or TCP packets that exceed the stack size or cause an out-of-bounds access in the kernel while parsing them. (as determined by system logs and crash dumps)
How this works: Public web server with a vulnerable kernel receives a crafted packet and it is either temporarily or permanently becomes unavailable to legitimate users due and being unable to support the load of crafted packets from an attacker.
Why It Matters for Companies
A temporary denial of service (DoS) is often a sign of an underlying problem like compromise through an initial access method such as phishing or an exploit. Remote DoS can greatly impact the availability of servers, APIs and cloud gateways.
Practical Steps to Reduce Risk
1. Maintain updated kernels and operating systems through updating their kernels as often as possible and utilizing auto updates wherever possible.
2. Reducing one's attack surface can be accomplished by disabling unneeded kernel modules (ie. NFS), running separate namespaces for unprivileged, and not allowing multiple unprivileged services to communicate with one another.
3. Consider using hardening techniques you've already implemented, such as Grsecurity/PaX-style patches and using Windows' exploit guard with seccomp in container environments.
4. Maintain visibility of potential kernel panics or crashes through monitoring oops and panic logs along with looking for BSOD dumps to review using WinDbg or Crash.
5. When segmenting networks consider placing firewalls on RPC and NFS exposed kernel services while also implementing rate limiting for any traffic that seems suspicious.
6. For cloud service providers to consider using live kernel updates through kpatch or kcare to patch any issues without having to reboot the system.
Although kernel DoS exploits are almost never "all by themselves," usually a part of a larger problem, a kernel Denial Of Service (DoS) should only be one of many reasons to patch quickly, harden your configurations, and monitor kernel logs as basic security practices will close most avenues of attack.
