Analyzing and improving Linux kernel memory protection: a model checking approach
Understanding the Linux Kernel