CVE-2026-80714 (CVSS 9.8): Linux Root Escalation PoC Out

TL;DR

A critical Linux kernel vulnerability, tracked as CVE-2026-80714 (CVSS 9.8), affects the IPVS netfilter code. Researchers at NebuSec have published proof-of-concept exploit code plus a video. Their demonstration shows root privilege escalation on the latest Debian.

Why It Matters

Root access means total control of a machine. This Linux kernel vulnerability turns a local user into that outcome. With public exploit code and a working demo now available, the risk to unpatched systems climbs fast. Shared and multi-user hosts face the greatest exposure.

How the Attack Works

The flaw is a use-after-free in the IP Virtual Server (IPVS) subsystem. Synced connections can be created before their destination exists. When the destination is later added, the kernel copies flags into the connection. A synced connection can then wrongly inherit the one-packet flag while already hashed. Expiry then skips unlinking the hash node. This leaves a stale pointer to a freed connection object, which an attacker turns into memory corruption. The upstream fix drops that flag when binding synced connections.

Affected Versions and Exploitation Status

The bug was introduced in July 2010 and fixed upstream in July 2026. Kernels built with IPVS support across that long window are affected. NebuSec confirmed the release in a demonstration video. Public proof-of-concept code now exists. However, no active exploitation in the wild has been confirmed.

Today's exploit is for the latest Debian, a UAF in netfilter: CVE-2026-80714.

It was introduced in Jul 2010 and fixed upstream in Jul 2026.

Discovered and exploited by the NebuSec security pipeline.

Exp source code: https://t.co/d7p8pHR5dF pic.twitter.com/jZ3QkY6PX6

— Cyber Meowfia (@cybermeowfia) August 31, 2026

Patch and Mitigation

Update to a kernel that includes the upstream fix. Apply your distribution’s latest kernel package and reboot. Where patching lags, restrict local access and limit who can configure IPVS. The published proof-of-concept exploit code confirms CVE-2026-80714 is practical to weaponize, so treat kernel updates as a priority.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.