KernelDiag: Agent-Based Root Cause Diagnosis for Kernel Crashes

2026-07-20

AI Summary

This work addresses the longstanding challenge of diagnosing root causes of Linux kernel crashes, which has traditionally relied on manual analysis and remains difficult for existing large language model approaches due to sparse low-level information, heterogeneous evidence sources, and complex fault propagation. To overcome these limitations, we propose KernelDiag—the first framework integrating multi-agent collaboration with structured causal reasoning. KernelDiag aligns logs and source code to unify heterogeneous evidence, employs specialized agents to iteratively reason over source semantics and kernel configurations, and constructs an evidence graph to enable method-level fault localization and interpretable diagnosis. Evaluated on the real-world KGYM dataset, KernelDiag substantially outperforms current methods, achieving up to 4× higher Top@k accuracy at the file level and 2× at the method level. Human and LLM evaluations confirm that its generated causal explanations are accurate, coherent, and actionable.

Abstract

The Linux kernel is one of the most complex software systems, where automated fuzzing continuously exposes thousands of crashes, yet root-cause diagnosis remains a manual and time-consuming bottleneck. Existing LLM-based root cause analysis (RCA) techniques, effective for distributed systems, do not readily generalize to kernel debugging due to sparse low-level artifacts, heterogeneous diagnostic evidence (e.g., syscalls, logs, and crash reports), and complex non-linear fault propagation that demands fine-grained method-level reasoning. To address these challenges, we propose KernelDiag, an agent-based framework for kernel root-cause diagnosis via structured causal reasoning. KernelDiag first aligns heterogeneous diagnostic artifacts through log-to-code mapping, and then employs artifact-specialized agents to iteratively reason over source-level program semantics and crash-specific kernel configurations. The inferred causal dependencies are incrementally organized into structured Evidence Graphs, enabling accurate faulty-method localization and causal explanations. We evaluate KernelDiag on the real-world KGYM benchmark. KernelDiag consistently outperforms state-of-the-art localization approaches at both file and method levels, achieving significant improvements in Top@k accuracy, including up to 4x and 2x gains in challenging settings without explicit hints. Furthermore, both human and LLM-assisted evaluations show that KernelDiag generates accurate, coherent, and actionable diagnostic explanations. Overall, this work lays the foundation for automated kernel root-cause diagnosis by bridging low-level diagnostic evidence with source-level causal reasoning.

Problem

• kernel crash
• root cause diagnosis
• heterogeneous diagnostic evidence
• fault propagation
• low-level artifacts

Innovation

• agent-based diagnosis
• kernel crash analysis
• causal reasoning
• evidence graph
• log-to-code mapping