CVE-2026-68162PoC

HIGHCVSS 7.8 · HIGH

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid auth_enable sysctl UAF during netns teardown proc_sctp_do_auth() updates the SCTP control socket after changing net.sctp.auth_enable. The handler gets the per-net SCTP state from ctl->data, so an already opened sysctl file can still target a network namespace while that namespace is being torn down. SCTP previously registered its per-net sysctls from sctp_defaults_init(), while the control socket is created later from sctp_ctrlsock_init(). This exposed a window during initialization where auth_enable was writable before net->sctp.ctl_sock existed, and a teardown window where auth_enable stayed writable after inet_ctl_sock_destroy() had released the control socket. Move the per-net SCTP sysctl registration into sctp_ctrlsock_init() after sctp_ctl_sock_init() succeeds, and unregister the sysctl table before destroying the control socket in sctp_ctrlsock_exit(). If sysctl registration fails after the control socket was created, destroy the control socket in the same init path. Make sctp_sysctl_net_unregister() tolerate a missing header and clear the saved pointer so init-error and exit paths can safely share the unregister helper.

Back to dashboard

7.5/ 10 priority

Sources & remediation

Other references

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
11 mentions across 7 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 7 signals
PoC mentioned or linked in 9 signals
Patch or workaround mentioned in 7 signals
Technical details provided in 8 signals
Peaked 6d ago at 3 mentions (2026-08-29); latest day: 1
11 total mentions across 7 days

Deep dive

Activity timeline11 mentions / 7d

Signal classification4 categories

PoC

545.5%

Patch

327.3%

Exploit

218.2%

General

19.1%

Referenced assets15 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-29	3	Exploit1Patch1PoC1
2026-08-31	1	Exploit1
2026-09-02	3	Patch1PoC2
2026-09-03	1	PoC1
2026-09-04	1	PoC1
2026-09-12	1	General1
2026-09-15	1	Patch1

Full discourse11 posts

Nebula Security@nebusecurity45d
Exploit
Today's exploit is again for the latest Ubuntu 26.04, a UAF in SCTP: CVE-2026-68162. It was introduced in Jan 2025 and fixed upstream in Jul 2026. Discovered and exploited by the NebuSec security pipeline. Exp source code: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-68162-Ubuntu-7.0.0-28 https://t.co/lUPlkcZHwM
Post summary
NebuSec released exploit code for CVE-2026-68162, a UAF vulnerability in Ubuntu 26.04's SCTP, but no active attacks or patches are reported.
63331866317.4K
7.2K followersView on X
Cyber Meowfia@cybermeowfia43d
Exploit
Aug 28: Today's exploit is for the latest Ubuntu 26.04, a UAF in SCTP: CVE-2026-68162. It was introduced in Jan 2025 and fixed upstream in Jul 2026. Discovered and exploited by the NebuSec security pipeline. Exp source code: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-68162-Ubuntu-7.0.0-28 https://t.co/0xQ6bU4pwS
Post summary
The text focuses on a UAF vulnerability in SCTP on Ubuntu 26.04 and explicitly shares exploit source code via a GitHub link, while also noting an upstream fix and NebuSec pipeline exploitation. The main takeaway is the availability of exploit code rather than in-the-wild active exploitation.
0201612.2K
439 followersView on X
yousukezan@yousukezan42d
PoC
LinuxカーネルのSCTP実装に、ローカルの低権限ユーザーがrootへ昇格できる脆弱性「CVE-2026-68162」が見つかった。NebuSecはUbuntu 26.04で動作するPoCを公開しており、実悪用はまだ確認されていない。問題はネットワーク名前空間の終了処理中に発生するuse-after-freeである。SCTPのper-net sysctlが制御ソケット作成前に登録され、ソケット破棄後も書き込み可能な状態が残るため、開いたままのsysctlファイルから終了中の名前空間を操作できる。 NebuSecのPoCは、この競合状態からメモリ破壊を起こし、ローカルユーザーをrootへ昇格できることを示した。脆弱性は2025年1月に導入され、2026年7月にupstreamで修正された。SCTPを有効にしたこの期間のカーネルが影響を受ける。修正では、sysctl登録を制御ソケット作成後へ移し、ソケット破棄前に登録解除する。影響環境では修正版カーネルへの更新と再起動が必要で、更新が遅れる場合はローカルアクセス制限と不審なsysctl操作の監視が挙げられている。 https://securityonline.info/linux-kernel-cve-2026-68162-root-escalation/
Post summary
A local privilege escalation flaw in the Linux kernel’s SCTP implementation was discovered and a PoC was released, though no active exploitation has been observed; a patch correcting sysctl registration logic is available.
0301322.0K
16.1K followersView on X
Mr. OS@ksg93rd31d
General
#Analytics #Threat_Research An analytical review of the main cybersecurity events (Sep 05-12, 2026) 1⃣ Sonicwall SMA1000 Attack https://hunt.io/blog/sonicwall-sma1000-uk-council-attack // CVE-2026-15409 2⃣ Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://hunt.io/blog/sonicwall-sma1000-uk-council-attack 3⃣ Next Nightmare Eclipse Vulnerability https://github.com/MSNightmare/ShieldCrash/blob/main/README.md // Microsoft has failed to properly patch ShieldBreak CVE-2026-69414.. 4⃣ FortiPAM Vulnerability https://amibeingpwned.com/blog/fortinet-pam-vuln // CVE-2026-84388 5⃣ Researchers from Nebula Security have disclosed 18 vulnerabilities in the Linux kernel https://www.openwall.com/lists/oss-security/2026/09/08/1 // CVE-2026-80714, CVE-2026-74597, CVE-2026-74581, CVE-2026-74480, CVE-2026-72255, CVE-2026-72137, CVE-2026-68376, CVE-2026-68162, CVE-2026-64560, CVE-2026-63834, CVE-2026-52933, CVE-2026-52929, CVE-2026-52924, CVE-2026-52923, CVE-2026-52912, CVE-2026-43501, CVE-2026-43502, CVE-2026-43074, CVE-2026-43042, CVE-2026-31678, CVE-2026-31659, CVE-2026-23274 6⃣ Netscaler ADC Exploit 7⃣ Critical vulnerabilities in MikroTik RouterOS https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ 8⃣ GRAYRABBIT One-click backdoor // One click. Three critical failures. One backdoor https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou 9⃣ Attacks using browser-in-browser (BiTB) phishing techniques https://www.huntress.com/blog/phishing-bitb-rmm-attacks 🔟 Beltdown: Escaping the Claude Code sandbox https://www.accomplish.ai/blog/beltdown-escaping-the-claude-code-sandbox/ // An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user http://www.Geniebot.pro http://www.cyberpocket.org
Post summary
The post is a weekly roundup of major security events, citing recent attacks and newly disclosed CVEs, with evidence of active exploitation and a mention of patch status but lacking detailed technical or exploit information.
01052601
3.4K followersView on X
Daily CyberSecurity@Daily_CyberSec42d
Patch
CVE-2026-68162, a Linux kernel vulnerability in SCTP (CVSS 7.8), has public PoC code enabling root privilege escalation on Ubuntu 26.04. Patch now. #Linux #CVE202668162 #PrivilegeEscalation #SCTP #Kernel #InfoSec #UseAfterFree https://securityonline.info/linux-kernel-cve-2026-68162-root-escalation/
Post summary
A Linux kernel SCTP vulnerability (CVE‑2026‑68162, CVSS 7.8) allows root privilege escalation via publicly available PoC code; a patch for Ubuntu 26.04 is now released.
01061725
13.0K followersView on X
キタきつね@foxbook41d
PoC
CVE-2026-68162: Linux Kernel Root Escalation PoC Public（Linux Kernelの脆弱性「CVE-2026-68162」、root権限昇格のPoCが公開） #SecurityOnline (Sep 2) https://securityonline.info/linux-kernel-cve-2026-68162-root-escalation/
Post summary
The post announces that a Proof of Concept for the Linux Kernel CVE-2026-68162 root‑escalation vulnerability has been published and links to its location.
00031431
5.0K followersView on X
OS開発者@hacker_infra45d
Patch
家に帰ったら、 Red hatに報告するかな。 Rhel 6と7が影響を受けるというのもおかしい。公式がバックポートしてるのが5.10からだからおそらく6と7は影響受けないはず。そこも含めて家へ帰ったら確認してレッドハットに報告しとくか https://access.redhat.com/security/cve/cve-2026-68162 緩和策はこれもう何度も出ている脆弱性だから、慌てる必要はない。 echo 'install sctp /bin/false' > /etc/modprobe.d/disable-sctp.conf
Post summary
The message highlights that the CVE has known mitigation steps and advises referencing the Red Hat advisory for further details.
001211.1K
2.9K followersView on X
moton@moton41d
PoC
CVE-2026-68162: Linux Kernel Root Escalation PoC Public - https://securityonline.info/linux-kernel-cve-2026-68162-root-escalation/
Post summary
The post announces a publicly available Proof of Concept for CVE‑2026‑68162, a Linux kernel root‑escalation vulnerability, with no evidence of active exploitation or patch information.
00021282
756 followersView on X
Threat Landscape@LandscapeThreat28d
Patch
Researchers disclosed CVE-2026-43502, a Linux kernel local privilege-escalation vulnerability in the RDS zerocopy send path, alongside 20 additional exploitable Linux bugs. - An unprivileged local user can obtain root privileges without Linux capabilities or user namespaces when required networking, asynchronous I/O, and RDS components are enabled. - The vulnerability affects kernels from Linux v4.17 and was demonstrated on openSUSE with kernel 6.4.0-150600.23.100. - The issue was fixed by commit 44b550d88b26, first included in Linux v7.1-rc3; public exploits for the listed vulnerabilities are available. VULNERABILITY CVE-2026-23274 CVE-2026-31659 CVE-2026-31678 CVE-2026-43042 CVE-2026-43074 CVE-2026-43501 CVE-2026-43502 CVE-2026-52912 CVE-2026-52923 CVE-2026-52924 CVE-2026-52929 CVE-2026-52933 CVE-2026-63834 CVE-2026-64560 CVE-2026-68162 CVE-2026-68376 CVE-2026-72137 CVE-2026-72255 CVE-2026-74480 CVE-2026-74581 CVE-2026-74597 CVE-2026-80714
Post summary
The text announces the disclosure of CVE-2026-43502 and other Linux kernel vulnerabilities, providing technical details about the local privilege escalation and specifying that the issue was fixed in commit 44b550d88b26 (included in Linux v7.1-rc3), while noting that public exploits are available.
0002055
120 followersView on X
セキュリティ対策Lab@securityLab_jp40d
PoC
Linux Kernelの脆弱性 CVE-2026-68162、SCTPのUse-After-Freeでローカル権限昇格のおそれ　Ubuntu向けPoC公開 https://rocket-boys.co.jp/security-measures-lab/linux-kernel-cve-2026-68162-sctp-poc/ #セキュリティ対策Lab #security #securitynews #セキュリティ #脆弱性
Post summary
A proof‑of‑concept for the Linux kernel CVE‑2026‑68162, exploiting an SCTP use‑after‑free to achieve local privilege escalation on Ubuntu, has been published and linked, though no active exploitation or patch is mentioned.
01010270
625 followersView on X
Rıdvan Yağlı@ridvanyagli45d
PoC
🔴 Nebula Security tarafından, Ubuntu 26.04 LTS için yeni Linux kernel PoC'si yayınlandı! CVE-2026-68162 olarak izlenen açık, Linux kernel'in SCTP bileşenindeki bir Use-After-Free (UAF) zafiyetinden kaynaklanıyor. Bu açık Ocak 2025'te keşfedilmiş ve Temmuz 2026'da upstream'da düzeltilmiştir. PoC: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-68162-Ubuntu-7.0.0-28 https://x.com/nebusecurity/status/2093581170655260730/video/1
Post summary
Nebula Security released a PoC for CVE‑2026‑68162, a use‑after‑free flaw in Linux kernel’s SCTP module, with the issue fixed upstream and a public PoC repository linked.
00000250
2.1K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-68162

Nebula Security[verified]@nebusecurityExploit

NebuSec released exploit code for CVE-2026-68162, a UAF vulnerability in Ubuntu 26.04's SCTP, but no active attacks or patches are reported.

yousukezan[verified]@yousukezanPoC

A local privilege escalation flaw in the Linux kernel’s SCTP implementation was discovered and a PoC was released, though no active exploitation has been observed; a patch correcting sysctl registration logic is available.

キタきつね[verified]@foxbookPoC

The post announces that a Proof of Concept for the Linux Kernel CVE-2026-68162 root‑escalation vulnerability has been published and links to its location.

OS開発者[verified]@hacker_infraPatch

The message highlights that the CVE has known mitigation steps and advises referencing the Red Hat advisory for further details.

Threat Landscape[verified]@LandscapeThreatPatch

The text announces the disclosure of CVE-2026-43502 and other Linux kernel vulnerabilities, providing technical details about the local privilege escalation and specifying that the issue was fixed in commit 44b550d88b26 (included in Linux v7.1-rc3), while noting that public exploits are available.

セキュリティ対策Lab[verified]@securityLab_jpPoC

A proof‑of‑concept for the Linux kernel CVE‑2026‑68162, exploiting an SCTP use‑after‑free to achieve local privilege escalation on Ubuntu, has been published and linked, though no active exploitation or patch is mentioned.

Rıdvan Yağlı[verified]@ridvanyagliPoC

Nebula Security released a PoC for CVE‑2026‑68162, a use‑after‑free flaw in Linux kernel’s SCTP module, with the issue fixed upstream and a public PoC repository linked.

Cyber Meowfia@cybermeowfiaExploit

The text focuses on a UAF vulnerability in SCTP on Ubuntu 26.04 and explicitly shares exploit source code via a GitHub link, while also noting an upstream fix and NebuSec pipeline exploitation. The main takeaway is the availability of exploit code rather than in-the-wild active exploitation.