CVE-2026-72018

XBOW discovered and exploited CVE-2026-72018, an out-of-bounds write in the Linux kernel reachable by unprivileged users with CAP_NET_ADMIN. A seemingly weak 16-byte write primitive chains into local privilege escalation to root, with human judgment still needed at a few critical research moments.