Ubuntu has put early kernel fixes for CVE-2026-98432 in its -proposed pocket for 22.04 LTS and newer releases. The bug is a serious Linux kernel flaw that can let a remote user run commands as root without a login or any user action. The patches are still in testing, so many servers stay open for now.

Canonical’s security team says the flaw sits in how the Linux kernel sets up IPv4 TCP connections, and it affects kernel versions 4.4 and later. The fixed builds are 5.15.0-203.213 for Jammy (22.04), 6.8.0-149.149 for Noble (24.04), and 7.0.0-43.43 for Resolute (26.04). Stonking (26.10) is already fixed in 7.3.0-10.10, and Trusty (14.04) is not affected. Fixes for Xenial, Bionic and Focal are still pending.

Canonical runs tests on more than 2,000 certified servers and devices before it moves a kernel to the updates pocket. Teams that run their own acceptance tests can install the early builds today, as described in Canonical’s new SRU strategy for faster CVE fixes.

Ubuntu’s CVE-2026-98432 tracker rates the bug 9.8, which is Critical. Its own blog post calls the same score “High,” so readers may see both labels. The record was published on October 15, 2026.

The bug is a use-after-free. In plain terms, the kernel keeps using a piece of memory after it has already let go of it. One CPU frees the IP options of a new connection. Another CPU, handling a repeated SYN packet, still reads them while building a reply. The upstream fix delays that free with kfree_rcu(), so readers finish first.

Anthropic’s Frontier Red Team shared its research on October 27, 2026. It says an unreleased Claude model wrote a working exploit after one first prompt. The exploit targets Linux servers with a multipath TCP (MPTCP) listener.

It works in two stages. First, it makes the kernel send back extra bytes that may hold a kernel pointer, which defeats KASLR, a defense that hides where kernel code sits. Second, it overwrites a callback pointer so the kernel runs a payload and ends in a shell command as root.

A lost race only fails the handshake and does not crash the machine, so the attacker can retry. In the test, the leak took 48 minutes, and the shell took five more.

Cyber Security News covered this in Claude AI Exploits Linux Kernel Flaw to Execute Root Commands Without User Interaction. Our earlier report on Claude building Chrome and Linux exploit chains shows how this fits a wider pattern. Anthropic’s exploit has not been released. It also says this was a lab test and not a real-world incident.

Signs of Scanning in the Wild

Researcher Marcus Hutchins says his team has seen what looks like threat actors scanning the whole internet for affected systems. In a post on X, he reports that residential proxies and Russia-based VPN servers began probing port 443 with MPTCP connections as of November 2.

Normal scanners do not use MPTCP by default, so he strongly suspects this activity targets CVE-2026-98432. His scan on October 30 found about 2,102,043 servers reachable over MPTCP on port 443.

A deeper TLS scan found about 762,774. He says a valid HTTP request is not needed, so the true exposure is likely closer to 2.1 million. These counts show exposure only and do not prove the kernels are unpatched.

There is no public remote code execution exploit yet. Several denial-of-service proofs-of-concept do exist, and they give attackers a starting point.

Some people assumed MPTCP listeners were rare. Hutchins points out that Debian and several other kernels enable MPTCP by default. Go 1.24 and later also bind MPTCP sockets when the kernel allows it, so tools built on Go, such as Caddy, create the needed listener.

Ubuntu emphasizes that the flaw itself is not tied to MPTCP, and the MPTCP link comes only from the Anthropic exploit. Ubuntu’s security team says updates are the only proper fix. Hutchins adds that setting net.mptcp.enabled=0 does not close sockets that are already open, so those apps must restart. You can list MPTCP listeners with sudo ss -Mlnp.

For Admins

Run uname -r and compare the result with the fixed versions above. Ubuntu’s guide to enabling the -proposed pocket explains how to pull in the new kernel, and a reboot is needed afterward. Packages in -proposed are not chosen for upgrade by default, so you must name the pocket when you install.

For hosts that cannot update yet, Ubuntu’s tracker lists an nftables rule that drops incoming IPv4 TCP packets carrying IP options. It reduces risk but does not fully prevent exploitation, and it breaks any connection that relies on IP options.

Ubuntu 20.04 LTS and older need Ubuntu Pro. Focal and Bionic fall under Expanded Security Maintenance, while Xenial and Trusty need the Legacy add-on. Ubuntu Pro is free for up to five machines.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Attackers Started Scanning in the Wild for Linux Kernel RCE Flaw, Ubuntu Releases Fixes appeared first on Cyber Security News.

Autonomous security research platform XBOW has disclosed CVE-2026-72018, a high-severity Linux kernel vulnerability that converts a tightly constrained out-of-bounds memory write into local root access.

The flaw affects the DIBS loopback implementation used by the SMC-D shared-memory communication path, where a missing bounds check allows attacker-controlled data to be copied beyond an allocated kernel buffer.

The vulnerability is notable not only for its impact, but for the weakness of the available exploit primitive. XBOW’s research showed that the bug could reliably produce only 16 zero bytes at a partly controlled kernel-memory offset.

Despite this limitation, the researchers developed a local privilege-escalation exploit that elevated a process to root without requiring a separate information leak.

The issue exists in the dibs_loopback driver, which enables Shared Memory Communications Direct, or SMC-D, on standard x86 Linux systems without IBM Z hardware.

SMC-D was historically associated with IBM mainframe environments and Internal Shared Memory devices, leaving much of its code comparatively less scrutinized.

Adding the dibs_loopback virtual device changed that exposure. It made SMC-D reachable on commodity Linux systems through loopback networking, turning code once considered difficult to access into a local attack surface.

AI Agent Finds Linux Kernel Bug

XBOW found that a peer-controlled dmbe_idx value could influence offset calculations during SMC connection setup. That offset eventually reached the move_data() routine in the DIBS loopback driver, which performed a memcpy() operation without validating whether the supplied offset and write size remained within the destination buffer.

The upstream remediation adds validation for offset and size before the copy operation. Linux advisory information describes the flaw as an out-of-bounds write that could corrupt memory beyond the allocated buffer because software loopback lacks the hardware-enforced memory-region protections available in real ISM hardware.

The local attack scenario requires CAP_NET_ADMIN. XBOW used that capability to enable SMC-D functionality and manipulate loopback CLC handshake traffic through an NFQUEUE-based man-in-the-middle setup.

By modifying selected handshake fields, the exploit could force an out-of-bounds write into adjacent kernel memory. The usable effect was not an arbitrary write: it was a fixed 16-byte zero write positioned at a chosen alignment over a limited range.

Rather than attempting to build a more powerful primitive, researchers targeted the Linux kernel’s cred structure, which stores a process’s user and group identity fields.

If zero bytes land on fields including euid, the effective user ID becomes zero. Since Linux permission checks treat an effective UID of zero as root, the affected process can subsequently establish a full root identity and spawn a root shell.

This approach demonstrates a familiar exploitation lesson: a primitive does not need to be arbitrary to be security-critical. If a restricted write can zero security-sensitive state, it may still be sufficient for privilege escalation.

XBOW reported that its proof of concept succeeded on 22 out of 100 separate boots, with the first successful privilege escalation appearing on the seventh boot.

The experiment was performed on Ubuntu 24.04 using Linux 7.1.0-rc6 with kernel mitigations disabled, so that real-world reliability may differ across distributions, kernel builds, allocator behavior, and enabled mitigations.

The CVE record carries a CVSS 3.1 base score of 7.8, rated High, with a local attack vector, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact.

XBOW said its agent handled threat modeling, code auditing, bug discovery, validation, and much of the exploit-development process.

However, human researchers made several important interventions. They redirected the system toward a local privilege-escalation model, encouraged it to revisit packet interception after it initially discarded that option, and required it to validate the restricted zero-write behavior experimentally.

Researchers also pushed the agent to exploit the existing primitive directly rather than spending time seeking a more powerful use-after-free or arbitrary-write chain.

The findings highlight both the promise and current limits of autonomous vulnerability research. AI systems can sustain exhaustive code analysis and testing across obscure subsystems.

However, human judgment can still be decisive when evaluating costly attack paths, correcting stale assumptions, and reframing an exploit strategy.

Administrators should apply Linux kernel updates containing the DIBS loopback bounds-check fix and reboot affected systems. Organizations should also review workloads and containers granted CAP_NET_ADMIN, because that capability is central to the demonstrated local attack path.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post AI Agent Finds Linux Kernel Bug That Turns a Tiny Memory Write Into Root Access appeared first on Cyber Security News.

A 14-year-old Linux kernel vulnerability can let a local attacker escalate to root privileges and, in a proof-of-concept environment, escape a Docker container to compromise the underlying host.

The flaw in Linux’s AF_ALG userspace cryptographic interface stems from unsafe concurrent writes to the same socket used for operations like AES encryption and decryption.

Because an unprivileged local process can access this interface, it presents a valuable attack surface for kernel researchers and attackers alike.

Security researcher Muhammad Alifa Ramdhan of STAR Labs discovered the issue in 2025 while auditing Linux kernel code for Google’s kernelCTF program.

The research, completed with colleague Bing-Jhong Billy Jheng, demonstrated that the bug could be developed into a reliable local privilege-escalation exploit. The kernelCTF submission reportedly received a $113,337 reward.

CISA has also listed CVE-2025-39964 among vulnerabilities reported as exploited in the wild, increasing the urgency of patching.

14-Year-Old Linux Kernel Flaw

The underlying issue is a race condition in the AF_ALG sendmsg() handling path. Normally, the kernel collects cryptographic input across one or more requests and tracks those buffers using scatter-gather lists. A context flag named merge indicates that the final buffer has unused page space and that new data can be appended safely.

However, two threads can issue writes against the same AF_ALG operation socket. While the socket lock protects most state changes, the kernel releases that lock while a thread waits for writable buffer space. This permits another writer to modify the shared context before the original thread resumes.

According to IDNsec research, attackers can manipulate timing to leave ctx->merge enabled while the final scatter-gather list has no valid entries, causing a subsequent write to access metadata before the intended array via sg[-1].

That out-of-bounds access becomes dangerous because attacker-controlled heap data can influence the fake scatterlist metadata. Researchers used the condition to create a usercopy oracle and ultimately derive an arbitrary kernel write primitive. The exploit then overwrites core_pattern, a kernel setting that controls how Linux handles process core dumps.

When core_pattern begins with a pipe character, Linux executes the configured program as a core-dump handler. By replacing this value and crashing a child process, the proof of concept runs the attacker-controlled binary with root privileges.

Since containers share the host kernel, the same kernel-level primitive can enable a Docker container escape in affected configurations.

The vulnerable code was introduced with Linux 2.6.38 in 2011 and remained exposed for roughly 14 years. Affected versions include kernels before the fixed stable releases, subject to distribution backports. Public advisories identify fixed versions including Linux 5.10.246, 5.15.195, 6.1.155, 6.6.109, 6.12.50, and 6.16.10.

Upstream Linux developers fixed the problem by adding exclusive write ownership to AF_ALG contexts. The patch introduces a ctx->write state check, causing a second concurrent writer to fail rather than alter the socket’s shared state.

Administrators should promptly install their distribution’s patched kernel package and reboot into the updated kernel. Organizations should prioritize shared Linux infrastructure, container hosts, multi-user systems, and environments where untrusted local code or tenant workloads can execute.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post 14-Year-Old Linux Kernel Flaw Lets Local Users Gain Root Access and Escape Containers appeared first on Cyber Security News.

Four newly disclosed Linux kernel vulnerabilities could allow local attackers to corrupt kernel memory and escalate privileges to root on affected systems.

The flaws, named DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, affect long-standing networking code and have now received upstream fixes. The vulnerabilities are tracked as CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469.

DirtyAH6, tracked as CVE-2026-80844, affects IPv6 Authentication Header processing in Linux IPsec/XFRM code. The issue occurs when the kernel handles malformed IPv6 routing-header values without correctly validating the segments_left field. This can move an internal pointer outside the intended memory area and trigger an out-of-bounds memory operation.

The bug is primarily a local privilege escalation issue when an attacker can create or control suitable network namespaces. However, systems acting as IPv6 routers or gateways that use AH in transport mode could face remote denial-of-service risk under narrow conditions.

The researcher demonstrated remote root access in a laboratory setup with memory grooming, though achieving that through a remote-only attack was described as highly difficult.

TUNderflow, identified as CVE-2026-81000, exists in the TUN/TAP virtual network-device subsystem. A malicious local user can abuse oversized receive-headroom values passed through specific network-device configurations, including Open vSwitch paths.

The error causes an integer underflow during socket-buffer allocation, potentially placing packet data outside its allocated memory area and enabling out-of-bounds reads and writes.

PPPoEject, or CVE-2026-68121, is a use-after-free flaw in the Linux PPP over Ethernet implementation. The pppoe_sendmsg() function keeps a pointer to a PPPoE header while calling a lower-level device-header function.

That callback can reallocate the socket buffer and invalidate the original pointer. Later writes through the stale pointer may corrupt freed kernel memory. The upstream patch reloads the header pointer after device-header creation.

Linux Kernel Privilege Escalation Flaws

DiagSpill, tracked as CVE-2026-74469, affects SCTP diagnostic reporting through sock_diag. An SCTP association can contain up to 65,536 peer transports, while the related counter is only 16 bits wide.

When the count reaches the limit, it wraps to zero, causing the diagnostic code to reserve insufficient space before copying peer information. The resulting overwrite can extend far beyond the intended Netlink response buffer.

Unlike the first three issues, DiagSpill does not require unprivileged user namespaces or special Linux capabilities when SCTP and sctp_diag support are available.

Remote crash conditions may also exist if SCTP address-configuration features are enabled. However, those features are turned off by default.

Researcher Asim Viladi Oglu Manizada reported the issues to the Linux kernel security team in mid-July. Patches were released through coordinated disclosure and are now available in supported stable kernel branches.

Administrators should upgrade to a kernel release containing all four fixes. The first stable versions that address the complete set are Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4.

Where immediate patching is not possible, organizations should restrict unprivileged user namespaces and disable unused AH6, TUN/TAP, PPPoE, SCTP, or sctp_diag functionality. However, turning off user namespaces does not mitigate DiagSpill and is not a substitute for applying vendor kernel updates.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Linux Kernel Hit by Four Privilege Escalation Flaws Enabling Root Access appeared first on Cyber Security News.