Comment by avisaven

A very common methodology is using a technique called fuzzing. There exists many fuzzers which have produced great success finding a plethora of both non-exploitable and exploitable bugs for Linux [1] [2].

[1] https://github.com/kernelslacker/trinity [2] https://github.com/google/syzkaller/