CVE-2026-72018

Can agents find and exploit a Linux kernel bug? Where does autonomy break down? XBOW uncovered what human researchers had largely missed: a vulnerability buried deep in the Linux kernel—and took it all the way to a working LPE exploit. CVE-2026-72018: an out-of-bounds write vulnerability in the Linux kernel that can be triggered by an unprivileged user with administrative network capabilities (CAP_NET_ADMIN), providing a primitive that can be leveraged for local privilege escalation to root. 🧵 1/ The exploit reaching a shell as root (uid=0).

AI Agent Finds Linux Kernel Bug That Turns a Tiny Memory Write Into Root Access Details: https://cybersecuritynews.com/ai-agent-finds-linux-kernel-bug/ CVE-2026-72018 is a high-severity Linux kernel vulnerability that converts a tightly constrained out-of-bounds memory write into local root access. The flaw affects the DIBS loopback implementation used by the SMC-D shared-memory communication path; a missing bounds check lets attacker-controlled data be copied beyond an allocated kernel buffer. The issue exists in the dibs_loopback driver, which enables Shared Memory Communications Direct, or SMC-D, on standard x86 Linux systems without IBM Z hardware. #cybersecuritynews

Read more in the full technical write up here: https://xbow.com/blog/no-time-to-pwn-cve-2026-72018 https://t.co/8XUs2iZZtX

No Time to Pwn – Can AI Find and Exploit the Linux Kernel? https://xbow.com/blog/no-time-to-pwn-cve-2026-72018

No Time to Pwn – Can AI Find and Exploit the Linux Kernel? https://xbow.com/blog/no-time-to-pwn-cve-2026-72018

A 16-byte zero write became root. XBOW developed a working LPE for CVE-2026-72018, a Linux kernel OOB write in the DIBS loopback driver. CVSS 7.8 | EPSS 0.16% ExploitGrid: 31.3/100 No known public exploit 🔎 https://exploitgrid.net/vulnerabilities/CVE-2026-72018

Big security alert: AI agent discovered a Linux kernel bug (CVE-2026-72018) in the dibs_loopback SMC-D driver that converts a narrowly constrained memory write into full root access. Despite only permitting a fixed 16-byte zero write, the exploit zeros credential fields—triggering privilege escalation—without needing arbitrary write or info leaks. The attack requires CAP_NET_ADMIN, loopback networking, and a vulnerable kernel. Update systems, enforce minimal privileges, and patch now. #KernelSecurity #Linux #AI #Vulnerability #RootAccess #SMCD https://thedailytechfeed.com/ai-agent-uncovers-linux-kernel-vulnerability-allowing-root-access/

🚨 #Linux Kernel Flaw #CVE-2026-72018 Enables Root Access Through a Constrained Memory Corruption -Fact Checker: ✅: 3 ❌: 1 || 3/4 → Score: 75% 🦾 -Prediction: 📈 1 Positive | 📉 1 Negative https://undercodenews.com/linux-kernel-flaw-cve-2026-72018-enables-root-access-through-a-constrained-memory-corruption/