CVE-2026-68138PoC

MEDIUMCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdisc_rtab_list against concurrent get/put qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly linked list qdisc_rtab_list and a plain non-atomic 'int refcnt' with no lock. This was only safe because every caller historically held the RTNL mutex, which serialized all rate-table lookups, inserts and frees. That invariant no longer holds. cls_flower sets TCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false for it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through tcf_exts_validate_ex() -> tcf_action_init() -> tcf_action_init_1() -> tcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the RTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each adding a flower filter with a police action carrying the same rate, then race on qdisc_rtab_list and on the non-atomic refcnt, leading to a use-after-free / double-free of the kmalloc-2k struct qdisc_rate_table. qdisc_rtab_list is a single global (not per-netns), so the corrupted object is shared system-wide. BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160 qdisc_put_rtab+0x12f/0x160 tcf_police_init+0xda9/0x1590 tcf_action_init_1+0x460/0x6b0 tcf_action_init+0x439/0xa40 tcf_exts_validate_ex+0x42d/0x550 fl_change+0xddd/0x7da0 tc_new_tfilter+0xaa7/0x2420 rtnetlink_rcv_msg+0x95e/0xe90 which belongs to the cache kmalloc-2k of size 2048 Protect qdisc_rtab_list and the refcount with a dedicated spinlock. The (sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before taking the lock; if a concurrent inserter added an identical table in the meantime the freshly allocated one is freed under the lock, so no duplicate is leaked. qdisc_put_rtab() now decrements the refcount and unlinks under the same lock.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
15 mentions across 6 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 9 signals
PoC mentioned or linked in 12 signals
Patch or workaround mentioned in 4 signals
Technical details provided in 12 signals
Peaked 4d ago at 5 mentions (2026-08-13); latest day: 1
15 total mentions across 6 days

Deep dive

Activity timeline15 mentions / 6d

Signal classification4 categories

PoC

1066.7%

Exploit

213.3%

Patch

213.3%

Disclosure

16.7%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-12	1	PoC1
2026-08-13	5	Disclosure1Exploit1PoC3
2026-08-15	1	PoC1
2026-08-18	4	Exploit1Patch1PoC2
2026-08-19	3	PoC3
2026-08-21	1	Patch1

Full discourse15 posts

Rıdvan Yağlı@ridvanyagli44d
Exploit
🔴 Kritik Linux Kernel Açığı: CVE-2026-68138❗️ Linux çekirdeğinin trafik kontrol (net/sched) alt sisteminde bir race condition tespit edildi. CVE-2026-68138 kodlu bu açık, yerel bir kullanıcının root yetkisi elde etmesine olanak tanıyor. Güvenlik araştırmacısı Alejandro Ramos (aramosf), açığın PoC kodunu ve teknik detaylarını GitHub'da yayınladı. Ubuntu 22.04 üzerinde canlı exploit demosu da paylaştı. Bu açık linux upstream'da yamalandı, ancak linux dağıtımlarına henüz gelmemiş olabilir. Mutlaka takip ederek yama geldiğinde güncelleyin. PoC ve detaylar: https://github.com/aramosf/CVE-2026-68138
Post summary
The post details CVE-2026‑68138 as a net/sched race condition enabling local privilege escalation in the Linux kernel, provides a PoC and live exploit demo on GitHub, and notes that upstream has patched the issue but distribution updates may lag.
030020411613.7K
2.4K followersView on X
Alejandro Ramos@aramosf46d
PoC
I’ve published a proof of concept for CVE-2026-68138, race condition in the Linux kernel’s traffic-control subsystem (net/sched). including the code required to reproduce and validate the vulnerability. PoC and technical details: https://github.com/aramosf/CVE-2026-68138 https://t.co/p4Aa9ZIT3u
Post summary
The author has released a proof‑of‑concept GitHub repository for CVE‑2026‑68138, a race condition in the Linux kernel’s traffic‑control subsystem, but has not reported any active exploitation or patch information.
1331136559.5K
11.5K followersView on X
Nicolas Krassas@Dinosn44d
PoC
CVE-2026-68138 Linux qdisc rate-table race local privilege escalation PoC https://github.com/aramosf/cve-2026-68138
Post summary
A Proof‑of‑Concept for CVE‑2026‑68138, a local privilege escalation race condition in Linux qdisc rate-table, is publicly available on GitHub.
015077246.5K
161.5K followersView on X
Alejandro Ramos@aramosf43d
PoC
This is my third Proof of Concept (PoC) for privilege escalation in Linux. In this case, it comes from a commit that fixes the problem (still waiting for a CVE...). Linux AF_PACKET hard_header_len race: local root exploit (03390aa): https://github.com/aramosf/03390aa-packet-oob. The two previous ones were: CVE-2026-68138 https://github.com/aramosf/CVE-2026-68138 and CVE-2026-68398 https://github.com/aramosf/CVE-2026-68398. I keep wondering if I'm able to weaponize this with my limited knowledge, what other organizations are doing. We shouldn't be talking about embargoes; we should be talking about how to change processes that have remained unchanged for 20 years and are saturated and broken.
Post summary
The user shares a third PoC for a Linux privilege‑escalation race, linking to GitHub repos with exploit code, yet provides no evidence of live attacks, patches, or detailed vulnerability description.
216144244.6K
11.5K followersView on X
Daily CyberSecurity@Daily_CyberSec39d
PoC
A public PoC for CVE-2026-68138 escalates a normal Linux user to root through a qdisc rate-table race. Details and exploit code are now disclosed. #CVE202668138 #PrivilegeEscalation #LinuxKernel #qdisc #UseAfterFree #LPE https://securityonline.info/cve-2026-68138-privilege-escalation/
Post summary
The post announces a public PoC with disclosed exploit code for CVE-2026-68138, detailing a Linux kernel privilege‑escalation race condition, but it does not mention active exploitation or patches.
014251114.5K
13.0K followersView on X
ThreatWire@ThreatWire_39d
Exploit
🚨 CRITICAL UPDATE: Public PoC for CVE-2026-68138 now demonstrates Linux local privilege escalation to root. The exploit targets a qdisc rate-table race condition in the kernel, leading to a use-after-free/double-free condition. Full details and exploit code are now public: 🔗 https://github.com/aramosf/CVE-2026-68138 #Linux #Kernel #CVE #LPE #PoC #CyberSecurity #Infosec
Post summary
The tweet announces a publicly released PoC/exploit for CVE-2026‑68138 that demonstrates a Linux kernel local privilege escalation via a race condition, but provides no patch or evidence of active exploitation.
010037163.7K
1.6K followersView on X
ThreatWire@ThreatWire_45d
PoC
🚨 PoC RELEASED: Public exploit code is available for CVE-2026-68138, a Linux kernel use-after-free/double-free flaw in the traffic-control subsystem. A race condition in qdisc_rtab_list can corrupt a shared kernel object when concurrent RTM_NEWTFILTER requests access the same rate table. The flaw can trigger kernel memory corruption and potentially enable local privilege escalation. 🔗 https://github.com/aramosf/cve-2026-68138 #Linux #Kernel #CVE #PoC #CyberSecurity #LPE #Infosec
Post summary
The tweet announces a publicly available PoC and exploit for CVE‑2026‑68138, detailing a kernel use‑after‑free flaw that could enable local privilege escalation.
09036153.2K
1.6K followersView on X
dbugs@ptdbugs45d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-68138 Vendor: Linux Product: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdisc_rtab_list against concurrent get/put qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly linked list qdisc_rtab_list and a plain non-atomic 'int refcnt' with no lock. This was only safe because every caller historically held the RTNL mutex, which serialized all rate-table lookups, inserts and frees. That invariant no longer holds. cls_flower sets TCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false for it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through tcf_exts_validate_ex() -> tcf_action_init() -> tcf_action_init_1() -> tcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the RTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each adding a flower filter with a police action carrying the same rate, then race on qdisc_rtab_list and on the non-atomic refcnt, leading to a use-after-free / double-free of the kmalloc-2k struct qdisc_rate_table. qdisc_rtab_list is a single global (not per-netns), so the corrupted object is shared system-wide. BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160 qdisc_put_rtab+0x12f/0x160 tcf_police_init+0xda9/0x1590 tcf_action_init_1+0x460/0x6b0 tcf_action_init+0x439/0xa40 tcf_exts_validate_ex+0x42d/0x550 fl_change+0xddd/0x7da0 tc_new_tfilter+0xaa7/0x2420 rtnetlink_rcv_msg+0x95e/0xe90 which belongs to the cache kmalloc-2k of size 2048 Protect qdisc_rtab_list and the refcount with a dedicated spinlock. The (sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before taking the lock; if a concurrent inserter added an identical table in the meantime the freshly allocated one is freed under the lock, so no duplicate is leaked. qdisc_put_rtab() now decrements the refcount and unlinks under the same lock. Link: https://github.com/aramosf/cve-2026-68138 #dbugs_vuln
Post summary
The post announces a discovered PoC for CVE-2026-68138, provides exploit code via GitHub, details the vulnerability, and suggests a fix.
1601872.4K
3.6K followersView on X
kokumօtօ@__kokumoto39d
PoC
Linux Kernelのローカル権限昇格脆弱性CVE-2026-68138に対応するPoC（攻撃の概念実証コード）が公開。Linux 5.1以降に影響。細工されたネットワークフィルタ要求可能なレートテーブルにおける競合に起因するqdisc_rate_table構造体の解放後メモリ使用。PoCはrootシェル。 https://securityonline.info/cve-2026-68138-privilege-escalation/
Post summary
A PoC enabling local privilege escalation via a race condition in the Linux kernel’s qdisc_rate_table has been published, achieving a root shell, but no patch, active exploitation, or debunking is reported.
00074903
7.8K followersView on X
Rıdvan Yağlı@ridvanyagli36d
Patch
👉 RtabRace (CVE-2026-68138) ve VsockDrop (CVE-2026-53365) Linux kernel açıkları için AlmaLinux, Ubuntu ve CloudLinux tarafında güvenlik güncellemeleri ve/veya mitigasyon çalışmaları yayınlanmaya başladı. Kernelinizi güncellemeyi veya mitigation uygulamayı unutmayın.
Post summary
Security updates or mitigations for RtabRace (CVE‑2026‑68138) and VsockDrop (CVE‑2026‑53365) have been released for AlmaLinux, Ubuntu, and CloudLinux; users are advised to update or apply mitigations.
01010431
2.4K followersView on X
moton@moton39d
PoC
CVE-2026-68138: Linux Kernel Root PoC Disclosed - https://securityonline.info/cve-2026-68138-privilege-escalation/
Post summary
A PoC for the Linux kernel privilege escalation CVE‑2026‑68138 has been disclosed (link provided), but no exploit code, patch, or active exploitation details are included.
01010120
752 followersView on X
キタきつね@foxbook39d
PoC
CVE-2026-68138: 概念実証（PoC）エクスプロイトによりLinuxカーネルの権限昇格が可能になる CVE-2026-68138: PoC Exploit Enables Linux Kernel Privilege Escalation #DailyCyberSecurity (Aug 18) https://securityonline.info/cve-2026-68138-privilege-escalation/
Post summary
The post announces a proof‑of‑concept exploit for CVE‑2026‑68138 that enables privilege escalation on the Linux kernel, without providing exploit code, active‑attack evidence, or patch information.
00000290
4.9K followersView on X
Limitless Hosting@LimitlessHosts39d
Patch
🚨 Security Alert: CVE-2026-68138 (CVSS 7.8) A race condition in the Linux kernel networking scheduler (net/sched) creates a use-after-free vulnerability affecting global system memory. Read our full analysis and mitigation steps: 👇 https://limitlesshost.net/rtabrace-cve-2026-68138/ #Linux #CVE202668138 https://t.co/dcAcJYyZ6C
Post summary
The tweet announces CVE‑2026‑68138, details a race‑condition UAF in the Linux kernel, and points to a link offering analysis and mitigations, suggesting a workaround rather than a fully available patch.
0000048
95 followersView on X
CyberSignal | Cybersecurity News@XQOPTRX39d
PoC
CyberSec Daily ✓ · 🐧 Linux Security · August 18, 2026 🎯 Public exploit raises urgency around Linux kernel CVE-2026-68138 Fresh August 18 reporting highlights public proof-of-concept code for CVE-2026-68138, a Linux kernel vulnerability involving the networking scheduler. The underlying flaw is a race condition in the handling of qdisc rate tables, which can lead to use-after-free or double-free memory corruption. Red Hat classifies the flaw as important, while Amazon assigns it a CVSS score of 7.0. Public research now demonstrates privilege-escalation possibilities under specific configurations, increasing defensive interest in the bug. The published PoC should not be interpreted as meaning every Linux machine is remotely exploitable; local access and environmental prerequisites apply. 🔗 Sources: Red Hat / Ubuntu / SecurityOnline #Linux #CVE202668138 #KernelSecurity #PrivilegeEscalation #CyberSecurity #Vulnerability #PatchManagement
Post summary
A public proof‑of‑concept code for CVE‑2026‑68138 is available, detailing a race condition in the Linux kernel networking scheduler that can lead to memory corruption and privilege escalation, but there is no evidence of active exploitation or available patches.
0000082
75 followersView on X
Upwind Security MDR@UpwindMDR44d
Disclosure
⚠️High - Linux kernel net/sched qdisc_rate_table Race UAF/Double-Free (CVE-2026-68138) Linux kernel traffic control net/sched rate-table handling lets concurrent RTM_NEWTFILTER netlink requests mutate the global qdisc_rtab_list and a non-atomic qdisc_rate_table refcount without locking. This race can trigger use-after-free/double-free of shared qdisc_rate_table, leading to kernel crash or potential LPE system-wide. 👉Affected: linux_kernel (net/sched traffic control) versions with unfixed qdisc_rtab_list/refcount locking
Post summary
The text announces CVE‑2026‑68138, a race‑condition UAF/Double‑Free in Linux kernel traffic‑control that can lead to crashes or privilege escalation.
00000128
288 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-68138

Rıdvan Yağlı[verified]@ridvanyagliExploit

The post details CVE-2026‑68138 as a net/sched race condition enabling local privilege escalation in the Linux kernel, provides a PoC and live exploit demo on GitHub, and notes that upstream has patched the issue but distribution updates may lag.

Alejandro Ramos[verified]@aramosfPoC

The author has released a proof‑of‑concept GitHub repository for CVE‑2026‑68138, a race condition in the Linux kernel’s traffic‑control subsystem, but has not reported any active exploitation or patch information.

Nicolas Krassas[verified]@DinosnPoC

A Proof‑of‑Concept for CVE‑2026‑68138, a local privilege escalation race condition in Linux qdisc rate-table, is publicly available on GitHub.

Alejandro Ramos[verified]@aramosfPoC

The user shares a third PoC for a Linux privilege‑escalation race, linking to GitHub repos with exploit code, yet provides no evidence of live attacks, patches, or detailed vulnerability description.

ThreatWire[verified]@ThreatWire_Exploit

The tweet announces a publicly released PoC/exploit for CVE-2026‑68138 that demonstrates a Linux kernel local privilege escalation via a race condition, but provides no patch or evidence of active exploitation.

ThreatWire[verified]@ThreatWire_PoC

The tweet announces a publicly available PoC and exploit for CVE‑2026‑68138, detailing a kernel use‑after‑free flaw that could enable local privilege escalation.

dbugs[verified]@ptdbugsPoC

The post announces a discovered PoC for CVE-2026-68138, provides exploit code via GitHub, details the vulnerability, and suggests a fix.

kokumօtօ[verified]@__kokumotoPoC

A PoC enabling local privilege escalation via a race condition in the Linux kernel’s qdisc_rate_table has been published, achieving a root shell, but no patch, active exploitation, or debunking is reported.