---
id: 5569
title: "From a Netfilter Bug to kernelCTF: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10500 Bounty"
cve: CVE-2026-23274
cvss: 7.8
severity: high
source_domain: nebusec.ai
source_url: "https://nebusec.ai/research/cve-2026-23274-cos/"
published_at: "2026-04-14T00:00:00Z"
tags: ["ai-security", "kernel-security", "privilege-escalation", "linux-kernel", "exploit", "netfilter", "nebusec", "cve-2026-23274", "kernelctf"]
phying_url: "https://phying.com/item/5569"
lang: en
---

# From a Netfilter Bug to kernelCTF: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10500 Bounty

## Summary

NebuSec turns a Linux netfilter use-before-initialization bug (CVE-2026-23274) into a kernelCTF win, covering the uninitialized timer path, control-flow hijack and ROP chain to read the flag.

## Intelligence Metadata

- **Sources:** nebusec.ai
- **CVE:** CVE-2026-23274
- **CVSS:** 7.8
- **Published:** 2026-04-14T00:00:00Z
- **Original:** https://nebusec.ai/research/cve-2026-23274-cos/
- **Phying News:** https://phying.com/item/5569