PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

From a Netfilter Bug to kernelCTF: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10500 Bounty

nebusec.ai | vulnerability | High | CVE-2026-23274 | #ai-security | #kernel-security | #privilege-escalation | #linux-kernel | #exploit | #netfilter | #nebusec | #cve-2026-23274 | #kernelctf
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

NebuSec turns a Linux netfilter use-before-initialization bug (CVE-2026-23274) into a kernelCTF win, covering the uninitialized timer path, control-flow hijack and ROP chain to read the flag.
CVE
CVE-2026-23274
CVSS
7.8
Published
Collected

Related coverage

High · vulnerability · nebusec.ai
IonStack part III: Rooting Android 17 with GhostLock
GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebula Security that exists in every major distribution since 2011. After turning it into a stable privilege escalation and container escape, we took one step further and used GhostLock to develop the world's first public Android 17 root. This writeup covers the additional exploit techniques used to migrate the exploit for Android.
High · vulnerability · nebusec.ai
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years
A 15-year-old Linux kernel stack use-after-free was turned into reliable local privilege escalation and container escape, affecting essentially every unpatched major distribution.
vulnerability · theori.io
Linux Kernel Exploit (CVE-2022–32250) with mqueue
Exploiting CVE-2022-32250, a Netfilter nftables use-after-free write, to root Ubuntu 22.04: heap and KASLR leaks with mqueue, a modprobe_path overwrite, plus root-cause analysis and patch.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
High · vulnerability · github.com
CVE-2026-68398 PoC: Ubuntu PPPoL2TP kernel UAF local privilege escalation
The PoC turns a kernel UAF into local privilege escalation from an ordinary user to root, making it relevant for authorized Linux kernel research and patch validation. The race can panic or corrupt a system, so it should only run in an isolated, recoverable lab VM and affected kernels should be updated.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
Back