Do Son 
TL;DR
A researcher released proof-of-concept exploit code for CVE-2026-68138, a race condition in the Linux kernel traffic-control code. The flaw lets a local user escalate to root on affected systems. Public details and a working PoC are now available on GitHub. The bug carries a CVSS score of 7.0.
- CVE: CVE-2026-68138
- CVSS: 7.8 (High · CVSSv3)
- Product: Linux
- Affected: 470502de5bdb1ed0def643a4458593a40b8f6b66, 5.1
- Impact: net/sched: serialize qdisc_rtab_list against concurrent get/put
- Status: No confirmed exploitation yet
- Patched in: fb29e1b41052488ee3f2d115d4a870497ebd7f7d, f43ee0c0730d6191629b5ee1ceae27b1ebfdc047, 7.1.6, 7.2
- EPSS: 0.1% (30-day)
- Action: Update to fb29e1b41052488ee3f2d115d4a870497ebd7f7d, f43ee0c0730d6191629b5ee1ceae27b1ebfdc047, 7.1.6, 7.2 now
Why It Matters
This CVE-2026-68138 privilege escalation bug needs no administrator rights to start. Any local user with a shell can attempt it. The exploit builds its own user and network namespaces to reach the vulnerable code.
The affected code has shipped since Linux 5.1, released in 2019. As a result, the bug sat in the kernel for years. Many current distributions still run vulnerable kernels, which widens the exposure.
How the Attack Works
The Linux traffic-control layer uses rate tables to shape network traffic. Two helper functions, qdisc_get_rtab() and qdisc_put_rtab(), manage a global list and a non-atomic reference count.
Historically, the RTNL mutex serialized access to that list. However, the flower classifier runs without that lock. A crafted network filter request can therefore reach the rate-table helpers unlocked.
When two requests use the same rate table at once, they race the shared list and counter. Consequently, the kernel frees the same object twice or uses it after freeing. That corruption then drives a use-after-free of a struct qdisc_rate_table.
Because the list is global, requests from separate network namespaces still collide on one object. The published PoC chains this corruption into a full root shell. It does so without including any code here.
Affected Versions
The Linux CNA record traces the bug to commit 470502de5bdb, first shipped in Linux 5.1. Kernels from 5.1 through 7.1.5 are affected unless a vendor backport is present.
The stable series fixed the flaw in Linux 7.1.6, commit fb29e1b41052. Mainline fixed it in 7.2-rc5, commit f43ee0c0730d. The 7.2 development series before rc5 remains affected.
Distribution Status
The researcher inspected several Ubuntu kernels on 2026-08-12 and found the vulnerable code present. The Ubuntu 22.04 GA kernel, build 5.15.0-187, was fully exploited in a QEMU lab. Newer Ubuntu builds still carry the flaw but resist this specific exploit chain due to allocator hardening. Administrators should confirm the fixing commit in their exact kernel source rather than trust version numbers alone.
Patch and Mitigation Steps
First, update to a kernel that includes the fixing commit or its backport. The patch protects the rate-table list with a dedicated spinlock.
Next, restrict local access on shared and multi-tenant hosts until you patch. You can also disable unprivileged user namespaces where policy allows, since the exploit relies on them. Full technical details and the proof-of-concept exploit for CVE-2026-68138 live in the researcher’s public repository.
No in-the-wild exploitation has been confirmed at this time. Even so, a public PoC lowers the bar for attackers, so patch promptly.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
