PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-68138 PoC: Linux qdisc rate-table race local privilege escalation

github.com | tool | CVE-2026-68138 | #public-poc | #kernel-security | #privilege-escalation | #use-after-free | #linux-kernel | #exploit | #poc | #race-condition | #cve-2026-68138
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A PoC for CVE-2026-68138, a race in Linux qdisc rate-table code causing use-after-free or double-free; validated in QEMU, it escalates an ordinary process to root on vulnerable kernels.

Why it matters

The public PoC turns the kernel race into a reproducible local root-escalation chain. It requires specific kernel configuration and an isolated lab, but hosts exposing the relevant namespace, traffic-control, and module-loading capabilities should verify that the upstream fix or an equivalent backport is present.
CVE
CVE-2026-68138
Vendor
Linux
Product
Linux kernel
Affected versions
Linux 5.1 through 7.1.5; 7.2-rc1 through rc4
CVSS
7.8
Published
Collected

Related coverage

High · vulnerability · github.com
CVE-2026-68398 PoC: Ubuntu PPPoL2TP kernel UAF local privilege escalation
The PoC turns a kernel UAF into local privilege escalation from an ordinary user to root, making it relevant for authorized Linux kernel research and patch validation. The race can panic or corrupt a system, so it should only run in an isolated, recoverable lab VM and affected kernels should be updated.
High · vulnerability · nebusec.ai
IonStack part III: Rooting Android 17 with GhostLock
GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebula Security that exists in every major distribution since 2011. After turning it into a stable privilege escalation and container escape, we took one step further and used GhostLock to develop the world's first public Android 17 root. This writeup covers the additional exploit techniques used to migrate the exploit for Android.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
vulnerability · theori.io
Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)
A deep dive into CVE-2024-27394, a TCP-AO use-after-free caused by incorrect RCU API usage in the Linux kernel, covering RCU internals, the patch, and the ExpRace technique for reliable triggering.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
research · starlabs.sg
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.
Back