LLMSA-MC: Bridging LLM Reasoning and Static Analysis for Detecting Missing-Check Bugs in Linux Kernels

Abstract

Missing security checks on critical variables are an important class of semantic bugs in the Linux kernel and can lead to severe vulnerabilities. Existing approaches largely rely on static analysis, but heuristic rule-based and statistical approaches may fail to capture the semantic context needed to determine whether a security check is required. Recent advances in large language models (LLMs) offer an opportunity to complement static analysis with semantic reasoning. However, directly applying LLMs to kernel code remains challenging, particularly in identifying critical variables and interpreting security-check semantics. To address these challenges, we present LLMSA-MC, a framework that combines static analysis with LLM-based semantic reasoning for missing-check bug detection. LLMSA-MC incorporates three strategies: (1) Statement Type Classification, which guides LLMs to identify critical variables; (2) Precise Code Context Extraction, which provides relevant code context for semantic reasoning; and (3) Function Label Generation, which annotates function return values with semantic labels. Evaluation on curated intra- and inter-procedural benchmarks shows that LLMSA-MC improves F1-score by up to 39.01 and 33.66 percentage points, respectively, over baseline chain-of-thought (CoT) prompting. When integrated with a representative missing-check bug detection tool, LLMSA-MC reduces candidate reports by 55.38% while confirming 168 missing-check bugs in Linux kernel v4.20-rc5.

The authors' abstract, as published at the source. ACM Transactions on Software Engineering and Methodology, 2026 · DOI ↗