Exploitation observed; activity peaked at 6 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
DECLINING
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-09-04 | 6 | Exploit3PoC3 |
| 2026-09-05 | 2 | PoC2 |
| 2026-09-06 | 1 | PoC1 |
| 2026-09-12 | 1 | General1 |
| 2026-09-15 | 1 | Exploit1 |
‼️ Exploit disclosed for CVE-2026-52924... 9.8 CVSS Linux Root Privilege Escalation GitHub: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52924-ubuntu-7.0.0-28/ https://t.co/SMW4mr8Jb5
Post summary
The tweet announces the disclosure of a CVE-2026-52924 Linux privilege escalation exploit with a 9.8 CVSS score and provides a GitHub link to the exploit code.
Today's exploit is for the latest Ubuntu 26.04, a 9-year-old OOB in SCTP: CVE-2026-52924. It was introduced in Oct 2017 and fixed upstream in Jun 2026. Discovered and exploited by the NebuSec security pipeline. EXP source: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52924-ubuntu-7.0.0-28/ https://t.co/1KwTxvWPju
Post summary
The tweet announces an available exploit for CVE‑2026‑52924 against Ubuntu 26.04, linking to the code, noting its OOB nature in SCTP, and indicating a fix has been applied upstream.
🚨 Nebula Security tarafından, Linux kernel'de 9 yıldır gizlenen SCTP açığı için PoC/exploit yayınlandı! Açık, Linux kernel'in SCTP bileşenindeki bir güvenlik açığı. 2017'den beri Linux kernel'de bulunan CVE-2026-52924 adlı UAF açığı için çalışan exploit yayınlandı. Açığın Ubuntu 26.04 / kernel 7.0.0-28 üzerinde sömürüldüğü gösterildi. Bu açık, 7.0.0-29.29 kernel sürümünde düzeltildi. PoC: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52924-ubuntu-7.0.0-28/ https://x.com/cybermeowfia/status/2095706087064527011/video/1
Post summary
Nebula Security released a PoC and exploit for the Linux kernel SCTP UAF bug CVE-2026-52924, demonstrated on Ubuntu 26.04 kernel 7.0.0-28, with a patch available in kernel 7.0.0-29.29.
#Analytics #Threat_Research An analytical review of the main cybersecurity events (Sep 05-12, 2026) 1⃣ Sonicwall SMA1000 Attack https://hunt.io/blog/sonicwall-sma1000-uk-council-attack // CVE-2026-15409 2⃣ Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://hunt.io/blog/sonicwall-sma1000-uk-council-attack 3⃣ Next Nightmare Eclipse Vulnerability https://github.com/MSNightmare/ShieldCrash/blob/main/README.md // Microsoft has failed to properly patch ShieldBreak CVE-2026-69414.. 4⃣ FortiPAM Vulnerability https://amibeingpwned.com/blog/fortinet-pam-vuln // CVE-2026-84388 5⃣ Researchers from Nebula Security have disclosed 18 vulnerabilities in the Linux kernel https://www.openwall.com/lists/oss-security/2026/09/08/1 // CVE-2026-80714, CVE-2026-74597, CVE-2026-74581, CVE-2026-74480, CVE-2026-72255, CVE-2026-72137, CVE-2026-68376, CVE-2026-68162, CVE-2026-64560, CVE-2026-63834, CVE-2026-52933, CVE-2026-52929, CVE-2026-52924, CVE-2026-52923, CVE-2026-52912, CVE-2026-43501, CVE-2026-43502, CVE-2026-43074, CVE-2026-43042, CVE-2026-31678, CVE-2026-31659, CVE-2026-23274 6⃣ Netscaler ADC Exploit 7⃣ Critical vulnerabilities in MikroTik RouterOS https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ 8⃣ GRAYRABBIT One-click backdoor // One click. Three critical failures. One backdoor https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou 9⃣ Attacks using browser-in-browser (BiTB) phishing techniques https://www.huntress.com/blog/phishing-bitb-rmm-attacks 🔟 Beltdown: Escaping the Claude Code sandbox https://www.accomplish.ai/blog/beltdown-escaping-the-claude-code-sandbox/ // An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user http://www.Geniebot.pro http://www.cyberpocket.org
Post summary
The text is an event recap that lists multiple CVEs and security incidents, providing links to resources but lacking detailed technical, exploit, or patch information.
Setting up the machine to perform the test. CVE-2026-52924 PoC Exploit Disclosed: 9.8 CVSS Linux Root Privilege Escalation https://securityonline.info/linux-cve-2026-52924-poc/?utm_source=twitter&utm_medium=social_share
Post summary
The post announces a proof‑of‑concept exploit for CVE‑2026‑52924, a Linux privilege escalation vulnerability with a 9.8 CVSS score, and provides a link to the PoC.
Researchers disclosed CVE-2026-43502, a Linux kernel local privilege-escalation vulnerability in the RDS zerocopy send path, alongside 20 additional exploitable Linux bugs. - An unprivileged local user can obtain root privileges without Linux capabilities or user namespaces when required networking, asynchronous I/O, and RDS components are enabled. - The vulnerability affects kernels from Linux v4.17 and was demonstrated on openSUSE with kernel 6.4.0-150600.23.100. - The issue was fixed by commit 44b550d88b26, first included in Linux v7.1-rc3; public exploits for the listed vulnerabilities are available. VULNERABILITY CVE-2026-23274 CVE-2026-31659 CVE-2026-31678 CVE-2026-43042 CVE-2026-43074 CVE-2026-43501 CVE-2026-43502 CVE-2026-52912 CVE-2026-52923 CVE-2026-52924 CVE-2026-52929 CVE-2026-52933 CVE-2026-63834 CVE-2026-64560 CVE-2026-68162 CVE-2026-68376 CVE-2026-72137 CVE-2026-72255 CVE-2026-74480 CVE-2026-74581 CVE-2026-74597 CVE-2026-80714
Post summary
Researchers disclosed CVE-2026-43502 and related Linux kernel privilege-escalation bugs, noting that public exploits are available. The issue is fixed by commit 44b550d88b26 in Linux v7.1-rc3, with no indication of active in-the-wild exploitation.
Linux-CVE-2026-52924-ubuntu-7.0.0-28 https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52924-ubuntu-7.0.0-28/
Post summary
A GitHub repository is linked that likely hosts a proof‑of‑concept for Linux‑CVE‑2026‑52924; no evidence of active exploitation, patching, or false‑positive claims is present.
Discover the Linux CVE-2026-52924 exploit with public PoC code. Learn how this 9.8 CVSS kernel bug allows local root privilege escalation on Linux hosts. #CVE202652924 #LinuxKernel #PrivilegeEscalation #PoCExploit #InfoSec #Cybersecurity #LinuxSecurity https://securityonline.info/linux-cve-2026-52924-poc/ https://t.co/qxYbZJYB4X
Post summary
The post highlights a public PoC for CVE-2026-52924, describing its kernel root‑escalation capabilities, but offers no evidence of active exploitation or remediation.
CVE-2026-52924 https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52924-ubuntu-7.0.0-28/ https://t.co/ncmTT7wcXC
Post summary
The tweet links to a GitHub repository that presumably hosts proof‑of‑concept code for CVE‑2026‑52924, without noting active exploitation, patches, or detailed technical information.
CVE-2026-52924: Linux Privilege Escalation. Ubuntu 7.0.0-28 https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52924-ubuntu-7.0.0-28/
Post summary
The passage announces a GitHub-hosted Proof of Concept for CVE-2026-52924, a Linux privilege escalation vulnerability affecting Ubuntu 7.0.0-28.
Exploit disclosed for CVE-2026-52924... 9.8 CVSS Linux Root Privilege Escalation GitHub PoC: https[:]//github[.]com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52924-ubuntu-7.0.0-28/ EPSS Lookup: https[:]//epsslookuptool[.]com/?cve=CVE-2026-52924 https://t.co/TLks13xVZ2
Post summary
An exploit for CVE-2026-52924, rated 9.8 CVSS as a Linux root privilege escalation, has been disclosed with a GitHub PoC; no active exploitation or patch information is mentioned.
7 of 7 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | linux | linux_kernel | - | - | - |
| OS | linux | linux_kernel | 7.1 | - | - |
| OS | linux | linux_kernel | 7.1 | - | - |
| OS | linux | linux_kernel | 7.1 | - | - |
| OS | linux | linux_kernel | 7.1 | - | - |
| OS | linux | linux_kernel | 7.1 | - | - |
| OS | linux | linux_kernel | 7.1 | - | - |