AutoKFL: Linux Kernel Fault Localization via ReAct-Based Multi-Agent Framework with Dynamic Crash Reproduction

Fault localization (FL) is the task of identifying code locations responsible for bugs in software, and it is a prerequisite step in the bug-fixing process. FL in large-scale systems such as the Linux kernel involves three core challenges: First, the vast codebase fundamentally complicates fault search. Second, the structural characteristics of the kernel environment severely restrict runtime visibility. Third, the diverse and non-trivial root causes of kernel faults expand the reasoning space exponentially. To address these challenges, we make the following observations: (1) decomposing the analysis process into functionally separated agents progressively narrows the search scope, (2) sufficient information for analysis can be extracted from static artifacts collected at crash time without runtime instrumentation, and (3) iterative interaction among agents extends the search scope to non-trivial root causes. Based on these observations, we propose AutoKFL, an automated FL system for Linux kernel crashes. AutoKFL employs four cooperating large language model (LLM)-based agents-crash observer, code collector, code analyzer, and evidence synthesizer-to perform crash observation, code collection, code analysis, and evidence synthesis in sequence. Each agent operates in a reasoning-acting (ReAct) manner and supports iterative exploration through conditional routing that allows returning to a prior stage when necessary. In experiments on 208 Linux kernel crashes reported on Syzbot, AutoKFL achieved a file-level Recall@1 of 0.77 and a mean reciprocal rank (MRR) of 0.822, outperforming single-LLM-call approaches across both file-level and function-level localization.