CVE-2026-74480 (CVSS 9.8): Linux Kernel Privilege Escalation PoC Public

A newly disclosed flaw in the Linux kernel enables local Linux kernel privilege escalation. Tracked as CVE-2026-74480 and rated CVSS 9.8, the bug lives in the network bridge module. Researchers from Nebula Security have already published proof-of-concept exploit code and a demo video.

TL;DR

CVE-2026-74480 is a use-after-free in the Linux kernel bridge code. It carries a CVSS score of 9.8. Public exploit code exists, and researchers demonstrated root privilege escalation. No in-the-wild exploitation has been confirmed yet.

Why It Matters

The Linux kernel bridge module runs on countless servers and appliances. A local attacker could turn this flaw into full root access. That outcome hands over complete control of the host.

The high CVSS 9.8 rating reflects that severity. Now that exploit code is public, the barrier to abuse drops sharply.

How the Attack Works

The bug sits in the multicast fast-leave path. During a fast leave, the code can access a port group after deletion. This creates a stale pointer, or use-after-free.

The condition triggers when multicast-to-unicast is enabled and then disabled. As a result, the bridge may hold duplicate port groups matched by port only. That memory corruption can crash the system or, per the researchers, allow privilege escalation. Nebula Security shared a demo video of the root privilege escalation on X.

Today's exploit is for the latest Red Hat Enterprise Linux 10.2, a UAF in net bridge, CVE-2026-74480.

It was introduced in Jan 2017 and fixed upstream in Jul 2026.

Discovered and exploited by the NebuSec security pipeline.

Exp source code: https://t.co/YJAXvWHzCn pic.twitter.com/XXSIDNtalX

— Nebula Security (@nebusecurity) August 24, 2026

Affected Versions

The flaw dates back to January 2017. Therefore many long-lived kernel branches are affected. Upstream developers fixed it in July 2026.

Patch and Mitigation Steps

Update to a patched kernel as soon as possible. The upstream fix breaks the loop after deleting a matching port group. Distribution vendors are shipping updates now, so apply them promptly.

Nebula Security published its proof-of-concept exploit code in a GitHub research repository targeting RHEL 10.2. Review it to build detections and confirm your exposure.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.