# MAccConc: Memory Access Concurrency Testing and Tracing Tool

> Explore MAccConc, a new developer tool for testing and discovering Linux kernel race conditions using memory access tracing and stack delays.

- Published: 2026-09-08T19:12:51.000Z
- Severity: info
- Category: Threat Intel
- Tags: Linux, Kernel, Race Condition, Vulnerability Discovery, Developer Tooling
- Author: Runtime Rebel Intel
- Primary source: https://projectzero.google/2026/09/maccconc-race-condition.html
- Canonical: https://runtimerebel.com/blog/maccconc-memory-access-concurrency-testing-and-tracing-tool

## Key points

- Immediate impact: Security researchers and developers gain a new method to discover and verify complex multi-threaded concurrency flaws.
- Affected systems: Linux kernel environments configured with specific instrumentation and debugging frameworks.
- Remediation: Review open-source repository documentation and adopt memory access tracing tools for proactive concurrency testing.

## Overview of Concurrency Testing Challenges

Security analysis of multi-threaded software often exposes race conditions, where correct execution depends entirely on precise thread interleaving. Discovering these flaws manually or via static analysis presents significant validation challenges. According to research published by [Project Zero](https://projectzero.google/2026/09/maccconc-race-condition.html), writing reliable regression tests for fixed race conditions remains notoriously difficult because triggering the exact timing window in standard test suites is rarely deterministic.

Traditional approaches to Linux kernel debugging frequently rely on recompiling binaries with conditional `mdelay()` calls or leveraging hypervisor-level tracking. However, these methods require extensive trial and error. To address this friction, new open-source tooling named **MAccConc** (Memory Access Concurrency) has been released to help security professionals explore potential thread interleavings more systematically.

## Technical Details of MAccConc

MAccConc provides automated testing for A-B-A thread interleavings alongside terminal and graphical user interfaces for manual exploration. The underlying architecture borrows concepts from prior academic work such as the SKI concurrency analysis model, but adapts the methodology for native kernel execution rather than relying entirely on modified full-system emulators like QEMU.

### Collecting Memory Access Coverage

Identifying communication points—pairs of memory accesses on separate threads where at least one operation writes to an overlapping memory range—requires tracking instruction-level interactions. Instead of patching emulator translation blocks, the tooling leverages compiler instrumentation:

* **KASAN Integration:** Utilises AddressSanitizer in outline mode (`CONFIG_KASAN_OUTLINE`) to emit helper function calls on memory accesses.
* **KCOV Mechanism:** Adapts the existing Linux kernel coverage infrastructure to record memory access traces due to its high-frequency event design and efficient in-memory representation.
* **Compiler Modifications:** Patches disable standard optimisations that merge subsequent memory access checks, ensuring every individual access generates a distinct trace callback.

## Actionable Recommendations and Mitigations

Security engineers and kernel developers should evaluate concurrency testing frameworks during internal code audits to reduce the risk of subtle logic flaws:

* **Adopt Memory Tracing:** Integrate tools that trace memory access concurrency to uncover hidden race conditions during pre-production [fuzzing](/glossary#fuzzing) campaigns.
* **Review Test Coverage:** Ensure multi-threaded unit tests evaluate boundary conditions and alternative thread schedules rather than relying on standard execution flows.
* **Monitor Upstream Repositories:** Keep track of developer tooling updates on GitHub under the MAccConc project for ongoing improvements to userspace fuzzing integration.

**Related:** [CVE-2026-64561: Zapscape KVM Flaw Allows Guest VM Escape](/blog/cve-2026-64561-zapscape-kvm-flaw-allows-guest-vm-escape), [UEFI Shim Bootloader Vulnerabilities: Secure Boot Blind Spot](/blog/uefi-shim-bootloader-vulnerabilities-secure-boot-blind-spot)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/maccconc-memory-access-concurrency-testing-and-tracing-tool