CVE-2026-68162: Linux Kernel Root Escalation PoC Public

TL;DR

A Linux kernel vulnerability, tracked as CVE-2026-68162, affects the SCTP networking code. It rates CVSS 7.8. Researchers at NebuSec have published proof-of-concept exploit code that escalates a local user to root on Ubuntu 26.04.

Why It Matters

Root access gives an attacker full control of a machine. This Linux kernel vulnerability turns a low-privileged local account into that outcome. With public exploit code now available, the risk to unpatched systems rises quickly. Multi-user and shared hosts face the greatest exposure.

How the Attack Works

The flaw is a use-after-free in the Stream Control Transmission Protocol (SCTP). It occurs during network namespace teardown. SCTP registered its per-net sysctls before the control socket existed, and left them writable after the socket was destroyed. As a result, an already-open sysctl file could still target a namespace being torn down. A local attacker triggers this window to corrupt memory. The published proof-of-concept exploit code shows how the memory corruption leads to root privilege escalation.

Affected Versions and Exploitation Status

The bug was introduced in January 2025 and fixed upstream in July 2026. Kernels built with SCTP support in that window are affected. The NebuSec team confirmed the public release in a disclosure post. A public proof-of-concept now exists. However, no active exploitation in the wild has been confirmed.

Patch and Mitigation

Update to a kernel that includes the upstream fix. The patch moves sysctl registration to after the control socket is created and unregisters it before the socket is destroyed. Apply your distribution’s latest kernel update and reboot. Where patching lags, restrict local access and monitor for unusual sysctl activity. Given the public exploit for CVE-2026-68162, treat kernel updates as a priority.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.