Autonomous large language model (LLM) based systems have recently shown promising results across a range of cybersecurity tasks. However, there is no systematic study on their effectiveness in autonomously reproducing Linux kernel vulnerabilities with concrete proofs-of-concept (PoCs). Owing to the size, complexity, and low-level nature of the Linux kernel, such tasks are widely regarded as particularly challenging for current LLM-based approaches. In this paper, we present the first large-scale study of LLM-based Linux kernel vulnerability reproduction. For this purpose, we develop K-Repro, an LLM-based agentic system equipped with controlled code-browsing, virtual machine management, interaction, and debugging capabilities. Using kernel security patches as input, K-Repro automates end-to-end bug reproduction of N-day vulnerabilities in the Linux kernel. On a dataset of 100 real-world exploitable Linux kernel vulnerabilities collected from KernelCTF, our results show that K-Repro can generate PoCs that reproduce over 50\% of the cases with practical time and monetary cost. Beyond aggregate success rates, we perform an extensive study of effectiveness, efficiency, stability, and impact factors to explain when agentic reproduction succeeds, where it fails, and which components drive performance. These findings provide actionable guidance for building more reliable autonomous security agents and for assessing real-world N-day risk from both offensive and defensive perspectives.

翻译：基于大型语言模型（LLM）的自主系统近期在多项网络安全任务中展现出潜力。然而，目前尚缺乏对其在自主复现Linux内核漏洞并生成具体概念验证（PoC）方面有效性的系统性研究。由于Linux内核的规模庞大、结构复杂且涉及底层操作，此类任务被广泛认为对当前基于LLM的方法具有特殊挑战性。本文首次开展了基于LLM的Linux内核漏洞复现的大规模研究。为此，我们开发了K-Repro系统——一个配备受控代码浏览、虚拟机管理、交互与调试能力的LLM智能体系统。以内核安全补丁作为输入，K-Repro实现了Linux内核N日漏洞端到端的自动化复现。在从KernelCTF收集的100个真实世界可利用Linux内核漏洞数据集上，实验结果表明K-Repro能以实际的时间与经济成本生成复现超过50%漏洞的PoC。除总体成功率外，我们通过深入分析有效性、效率、稳定性及影响因素，系统阐释了智能体复现的成功条件、失败场景及性能驱动要素。这些发现为构建更可靠的自主安全智能体，以及从攻防双重视角评估现实世界N日漏洞风险提供了可操作的指导。