CVE-2026-72137 (CVSS 9.8): Linux Kernel Flaw Enables Root Privilege Escalation, PoC Public

TL;DR

A double-free flaw in the Linux kernel, tracked as CVE-2026-72137, carries a CVSS score of 9.8. The bug sits in the xfrm subsystem’s nat_keepalive component and can lead to memory corruption. Researchers at NebuSec have publicly released proof-of-concept exploit code and a video showing root privilege escalation.

Why It Matters

The Linux kernel powers servers, cloud hosts, and containers worldwide. A double-free that yields root turns any low-level foothold into full control. Because working PoC exploit code is now public, the barrier to abuse drops sharply. Defenders should treat CVE-2026-72137 as urgent.

How the Attack Works

The flaw lives in nat_keepalive_send(). That function frees a network packet buffer, the skb, when the IPv4 or IPv6 send helper reports an error. This cleanup is safe only before the skb reaches the output path. Once the networking stack takes ownership, it may have already consumed the buffer. Freeing it again causes a double free, opening the door to memory corruption and privilege escalation. NebuSec demonstrated the impact in a video posted on X.

Today's exploit is for the latest Ubuntu 26.04, a double free in xfrm: CVE-2026-72137.

It was introduced in Jun 2024 and fixed upstream in Jul 2026.

Discovered and exploited by the NebuSec security pipeline.

Exploit source code: https://t.co/dT3jB4J1sM pic.twitter.com/Hq4Vy0qIIo

— Nebula Security (@nebusecurity) August 27, 2026

Affected Versions

The bug was introduced in June 2024 and fixed upstream in July 2026. Kernel builds carrying the vulnerable nat_keepalive code in that window are affected. NebuSec’s public research references an Ubuntu 7.0.0-28 target build.

Patch and Mitigation Steps

Update to a kernel that includes the upstream fix. Most major distributions ship patched kernels through routine updates. Apply those updates now, then reboot. Where patching must wait, limit local access and monitor for unexpected privilege changes. The full PoC and technical notes sit in the NebuSec CyberMeowfia repository. No in-the-wild exploitation has been confirmed yet, but public exploit code makes fast patching essential.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.