{"id":183301,"date":"2026-09-09T22:54:13","date_gmt":"2026-09-09T20:54:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/18-uyazvimostej-v-yadre-linux-c-eksploitami-dlya-polucheniya-prav-root-v-sisteme"},"modified":"2026-09-09T22:54:19","modified_gmt":"2026-09-09T20:54:19","slug":"18-linux-kernel-vulnerabilities-with-exploits-to-gain-root-access","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/18-linux-kernel-vulnerabilities-with-exploits-to-gain-root-access","title":{"rendered":"18 vulnerabilities in the Linux kernel with exploits for gaining root privileges in the system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from Nebula Security uncovered details about 18 vulnerabilities in the Linux kernel and prepared exploits that allow an unprivileged local user to obtain root rights in the system. The vulnerabilities have been resolved in various spring and summer kernel updates. Identified issues: <\/p>\n
\n
CVE-2026-43502 (exploit) \u2014 a vulnerability in the RDS (Reliable Datagram Sockets) network subsystem, caused by improper cleanup of pinned memory pages during data sending failures in zerocopy mode before queuing the message. The issue has been code-named ZcopyReaper, appearing starting from kernel version 4.17 and fixed in the kernel in May. Exploitation of the vulnerability is possible on systems with kernels built with the CONFIG_INET=y, CONFIG_AIO=y, CONFIG_RDS=y|m, and CONFIG_RDS_TCP=y|m options (typically set by default). No special user namespace identifier permissions are required for the attack. The exploit has been demonstrated on openSUSE with the standard kernel 6.4.\n
CVE-2026-80714 (exploit) \u2014 a vulnerability in the IPVS (IP Virtual Server) subsystem, caused by accessing memory after it has been freed due to incorrect setting of the IP_VS_CONN_F_ONE_PACKET flag during connection synchronization, which after the connection's lifetime expires leads to dangling pointers remaining in the hash table, pointing to the already freed ip_vs_conn structure. The issue was resolved on August 19. The exploit has been demonstrated on Debian 13 with kernel 6.12.\n
CVE-2026-74597 (exploit) \u2014 a vulnerability in the ip6_tunnel driver, caused by incorrect application of an offset to an encapsulated packet for the HAO (Home Address Option) based on an external packet. By sending an encapsulated packet with a specially crafted header, it is possible to achieve a buffer overflow. The issue was resolved on August 19. The exploit has been demonstrated on CentOS with kernel 6.12.\n
CVE-2026-74581 (exploit) \u2014 a vulnerability in the code for handling IPv6 routing tables, caused by accessing memory after it has been freed (an active pointer to the route remained after freeing memory for the route). The issue was resolved on August 19. The exploit has been demonstrated on Debian 13 with kernel 6.12.\n
CVE-2026-74480 (exploit) \u2014 a vulnerability in the network bridge subsystem, caused by accessing memory after it has been freed in the code for exiting a multicast group (after removing an element from the linked list, the cycle was not interrupted, and during iterations, memory was accessed through a pointer to the ports list that remained after deletion). The issue was resolved on August 9. The exploit has been demonstrated on RHEL 10 with kernel 6.12.\n
CVE-2026-72255 (exploit) \u2014 a vulnerability in the nf_queue module of the netfilter subsystem, caused by accessing memory after it has been freed, occurring when a packet associated with a removed network bridge is still in the NFQUEUE. The issue was resolved on July 24. The exploit demonstration was shown on Ubuntu 26.04 with kernel 7.0.\n
CVE-2026-72137 (exploit) \u2014 a vulnerability in the IPSec XFRM module, leading to a double free of the skb structure upon a keepalive packet sending error. The issue was resolved on June 30. The exploit demonstration was shown on Ubuntu 26.04 with kernel 7.0.\n
CVE-2026-68376 (exploit) \u2014 a vulnerability in the SCTP protocol implementation, causing a buffer overflow due to an incorrect calculation of the array size for storing HMAC identifiers. The issue was resolved on August 3. The exploit demonstration was shown on Ubuntu 26.04 with kernel 7.0.\n
CVE-2026-68162 (exploit) \u2014 a vulnerability in the SCTP protocol implementation, leading to accessing memory after it has been freed when attempting to change a sysctl parameter after closing the control socket. The issue was resolved on April 10. The exploit demonstration was shown on Ubuntu 26.04 with kernel 7.0.\n
CVE-2026-64560 (exploit) \u2014 a vulnerability in posix-cpu-timer, leading to accessing memory after it has been freed due to a race condition between deleting a timer and calling exec() after changing the thread group leader. The issue was resolved on July 5. The exploit demonstration was shown on a Google Pixel device running Android.\n
CVE-2026-52933 (exploit) \u2014 a vulnerability in the io_uring subsystem, leading to accessing memory after it has been freed when the IO_POLL_CANCEL_FLAG is set, due to interpreting the atomic_read() value as a negative number when compared to the reference counter. The issue was resolved on April 15. The exploit demonstration was shown on Fedora Linux with kernel 6.19.\n
CVE-2026-52924 (exploit) \u2014 a vulnerability in the SCTP protocol implementation, causing accessing memory after it has been freed due to leaving an active pointer and data in the send queue after releasing the flow table following a 'Stale Cookie' error. The issue was resolved on June 19. The exploit demonstration was shown on Ubuntu 26.04 with kernel 7.0.\n
CVE-2026-52923 (exploit) \u2014 a vulnerability in the SysV IPC subsystem that leads to a use-after-free situation due to a dangling pointer to a freed index element remaining in the IDR structure. The issue was resolved on July 24. The exploit was demonstrated in RHEL 10 with kernel 6.12.\n
CVE-2026-52912 (exploit) \u2014 a vulnerability in the nf_queue module of the netfilter subsystem caused by accessing memory after it has been freed due to incorrect pointer handling after the removal of a network bridge while related packets remain in the NFQUEUE. The issue was resolved on June 1. The exploit was demonstrated in openSUSE with kernel 6.4.\n
CVE-2026-43501 (exploit) \u2014 a vulnerability in the re-packing code of the IPv6 SRH (Source Routing Header) leading to buffer overflow due to a lack of condition checking for when the new header may exceed the old one. The issue was resolved on May 7. The exploit was demonstrated at the kernelCTF competition.\n
CVE-2026-43042 (exploit) \u2014 a vulnerability in the MPLS mechanism that leads to out-of-bounds data access due to a race condition occurring when reading a lock and resizing a table simultaneously. The issue was resolved on April 11. The exploit was demonstrated in Debian 13 with kernel 6.12.\n
CVE-2026-31678 (exploit) \u2014 a vulnerability in the openvswitch subsystem caused by accessing memory after it has been freed in a race condition when removing a reference to a network device before the RCU (Read-Copy-Update) cycle is complete. The issue was resolved on April 2. The exploit was demonstrated in Fedora Linux 44 with kernel 6.19.\n
CVE-2026-31659 (exploit) \u2014 a vulnerability in the implementation of the B.A.T.M.A.N. (Better Approach to Mobile Ad-hoc Networking) protocol leading to buffer overflow due to integer overflow caused by using 16-bit values when calculating the buffer size. The issue was resolved on April 18. The exploit was demonstrated in Arch Linux with kernel 6.19. <\/ul>\n