VulnSocial

CVE-2026-72137PoC

HIGHCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 6 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: xfrm: nat_keepalive: avoid double free on send error nat_keepalive_send() frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error. That cleanup is only correct before the skb is handed to the output path. Once ip_build_and_send_pkt() or ip6_xmit() takes ownership, the networking stack may already have consumed the skb before returning an error, so freeing it again is unsafe. Handle the pre-handoff failure cases inside nat_keepalive_send_ipv4() and nat_keepalive_send_ipv6(), where the caller still owns the skb, and keep nat_keepalive_send() responsible only for family dispatch and the unsupported-family cleanup path.

Back to dashboard
7.5/ 10 priority

Sources & remediation

Other references

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 10 mentions across 5 observed days

What's happening

  • Active exploitation reported across 1 signal
  • Exploit tool or code specified in 6 signals
  • PoC mentioned or linked in 7 signals
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 7 signals
  • General: 1 classified signal
  • Peaked 4d ago at 6 mentions (2026-08-27); latest day: 1
  • 10 total mentions across 5 days

Deep dive

Activity timeline10 mentions / 5d
02356Mentions · 2026-08-27: 6Mentions · 2026-08-31: 1Mentions · 2026-09-08: 1Mentions · 2026-09-12: 1Mentions · 2026-09-15: 1PoC Mentioned / Linked · 2026-08-27: 6PoC Mentioned / Linked · 2026-09-12: 1Exploit Tool / Code · 2026-08-27: 5Exploit Tool / Code · 2026-08-31: 1Active Exploitation · 2026-09-12: 1Patch / Workaround · 2026-08-27: 2Patch / Workaround · 2026-09-15: 1Technical Details · 2026-08-27: 4Technical Details · 2026-08-31: 1Technical Details · 2026-09-12: 1Technical Details · 2026-09-15: 108-2708-3109-0809-1209-15
Signal classification5 categories
PoC
440.0%
Exploit
330.0%
General
110.0%
Active Exploitation
110.0%
Patch
110.0%
Referenced assets15 URLs
By indicator
Classification over time
DateTotalLabels
2026-08-276
Exploit2PoC4
2026-08-311
Exploit1
2026-09-081
General1
2026-09-121
Active Exploitation1
2026-09-151
Patch1
Full discourse10 posts
  • Nebula Security@nebusecurity
    Exploit

    Today's exploit is for the latest Ubuntu 26.04, a double free in xfrm: CVE-2026-72137. It was introduced in Jun 2024 and fixed upstream in Jul 2026. Discovered and exploited by the NebuSec security pipeline. Exploit source code: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-72137-ubuntu-7.0.0-28 https://t.co/Hq4Vy0qIIo

    Post summary

    The post announces the availability of functional exploit code for CVE‑2026‑72137—a double‑free vulnerability in Ubuntu 26.04’s xfrm subsystem—providing a source link and noting an upcoming upstream fix.

    01931155624.0K
    6.9K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    PoC

    A public PoC exploit targets CVE-2026-72137, a CVSS 9.8 Linux kernel double-free that enables root privilege escalation. Patch now. #CVE202672137 #LinuxKernel #PrivilegeEscalation #PoC #xfrm #InfoSec https://securityonline.info/cve-2026-72137-linux-kernel-lpe/

    Post summary

    A public PoC exploit has been released for CVE‑2026‑72137, a critical Linux kernel double‑free vulnerability; a patch is already available.

    015152203.7K
    13.0K followersView on X
  • Rıdvan Yağlı@ridvanyagli
    PoC

    🔴 Nebula Security tarafından CVE-2026-72137 için PoC yayınlandı. Linux kernel'in XFRM bileşenindeki double-free açığını tetiklemeyi amaçlayan PoC, güncel Ubuntu 26.04 sistemlerinde açığın istismar edilebilirliğini gösteriyor. PoC: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-72137-ubuntu-7.0.0-28 https://x.com/nebusecurity/status/2092803089170637235/video/1

    Post summary

    Nebula Security released a PoC that demonstrates a double‑free vulnerability in the Linux kernel’s XFRM module, showing it is exploitable on current Ubuntu 26.04 releases, with the proof of concept available on GitHub.

    014045183.2K
    2.4K followersView on X
  • Cyber Meowfia@cybermeowfia
    Exploit

    Aug 26: Today's exploit is for the latest Ubuntu 26.04, a double free in xfrm: CVE-2026-72137. It was introduced in Jun 2024 and fixed upstream in Jul 2026. Discovered and exploited by the NebuSec security pipeline. Exp source code: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-72137-ubuntu-7.0.0-28 https://t.co/Ksqrj1GU2d

    Post summary

    The tweet discloses a double‑free vulnerability (CVE‑2026‑72137) in Ubuntu 26.04’s xfrm, provides technical details, and shares a link to an exploit source code repository; it notes an upstream fix but does not confirm active exploitation in the wild.

    0602552.4K
    439 followersView on X
  • Hack32@Hack32_
    PoC

    The Linux kernel has a new Achilles' heel CVE-2026-72137 and its public PoC for escalating to root 🔓⚡ https://securityonline.info/cve-2026-72137-linux-kernel-lpe/?utm_source=twitter&utm_medium=social_share

    Post summary

    The post announces a new Linux kernel vulnerability (CVE-2026-72137) and notes that a public PoC for privilege escalation to root is available online.

    140136939
    828 followersView on X
  • dbugs@ptdbugs
    Exploit

    A PoC/exploit has been discovered for vulnerability CVE-2026-72137 Vendor: Linux Product: Linux kernel Description: A double free issue exists in the xfrm component. The nat keepalive send() function frees the keepalive skb (socket buffer) when the IPv4 or IPv6 send helper reports an error. This cleanup is unsafe after the skb is handed to the output path via ip build and send pkt() or ip6 xmit(), as the networking stack may have already consumed the skb before returning an error. Link: https://github.com/NebuSec/CyberMeowfia/blob/main/security-research/Linux-CVE-2026-72137-ubuntu-7.0.0-28/exploit.c #dbugs_vuln

    Post summary

    This post announces a proof‑of‑concept exploit for CVE‑2026‑72137, a double‑free vulnerability in the Linux kernel's xfrm component, with code hosted on GitHub; no patch or active exploitation has been reported.

    02074842
    3.6K followersView on X
  • Mr. OS@ksg93rd
    Active Exploitation

    #Analytics #Threat_Research An analytical review of the main cybersecurity events (Sep 05-12, 2026) 1⃣ Sonicwall SMA1000 Attack https://hunt.io/blog/sonicwall-sma1000-uk-council-attack // CVE-2026-15409 2⃣ Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://hunt.io/blog/sonicwall-sma1000-uk-council-attack 3⃣ Next Nightmare Eclipse Vulnerability https://github.com/MSNightmare/ShieldCrash/blob/main/README.md // Microsoft has failed to properly patch ShieldBreak CVE-2026-69414.. 4⃣ FortiPAM Vulnerability https://amibeingpwned.com/blog/fortinet-pam-vuln // CVE-2026-84388 5⃣ Researchers from Nebula Security have disclosed 18 vulnerabilities in the Linux kernel https://www.openwall.com/lists/oss-security/2026/09/08/1 // CVE-2026-80714, CVE-2026-74597, CVE-2026-74581, CVE-2026-74480, CVE-2026-72255, CVE-2026-72137, CVE-2026-68376, CVE-2026-68162, CVE-2026-64560,  CVE-2026-63834, CVE-2026-52933, CVE-2026-52929, CVE-2026-52924, CVE-2026-52923, CVE-2026-52912, CVE-2026-43501, CVE-2026-43502, CVE-2026-43074, CVE-2026-43042, CVE-2026-31678, CVE-2026-31659, CVE-2026-23274 6⃣ Netscaler ADC Exploit 7⃣ Critical vulnerabilities in MikroTik RouterOS https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ 8⃣ GRAYRABBIT One-click backdoor // One click. Three critical failures. One backdoor https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou 9⃣ Attacks using browser-in-browser (BiTB) phishing techniques https://www.huntress.com/blog/phishing-bitb-rmm-attacks 🔟 Beltdown: Escaping the Claude Code sandbox https://www.accomplish.ai/blog/beltdown-escaping-the-claude-code-sandbox/ // An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user http://www.Geniebot.pro http://www.cyberpocket.org

    Post summary

    The tweet outlines ten major cybersecurity events, citing new CVEs and evidence of active exploitation—particularly MikroTik RouterOS—though it offers no patch guidance or exploit code details.

    01052600
    3.4K followersView on X
  • Brad Spengler@spendergrsec
    General

    For oss-sec: CVE-2026-72137 needs xfrm, CVE-2026-52933 needs io_uring, CVE-2026-52929 needs sctp, CVE-2026-43502 needs rds (is what the original post was about)

    Post summary

    The snippet lists several CVE identifiers along with the subsystems they involve, without providing details on exploitation, patching, or proof‑of‑concepts.

    00042767
    7.1K followersView on X
  • Clandestine@akaclandestine
    PoC

    CyberMeowfia/security-research/Linux-CVE-2026-72137-ubuntu-7.0.0-28 at main · NebuSec/CyberMeowfia · GitHub https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-72137-ubuntu-7.0.0-28

    Post summary

    The link directs to a GitHub repository that appears to host a proof‑of‑concept for CVE-2026-72137 targeting Ubuntu 7.0.0-28, with no evidence of active exploitation, patches, or debunking.

    000032.2K
    63.4K followersView on X
  • Threat Landscape@LandscapeThreat
    Patch

    Researchers disclosed CVE-2026-43502, a Linux kernel local privilege-escalation vulnerability in the RDS zerocopy send path, alongside 20 additional exploitable Linux bugs. - An unprivileged local user can obtain root privileges without Linux capabilities or user namespaces when required networking, asynchronous I/O, and RDS components are enabled. - The vulnerability affects kernels from Linux v4.17 and was demonstrated on openSUSE with kernel 6.4.0-150600.23.100. - The issue was fixed by commit 44b550d88b26, first included in Linux v7.1-rc3; public exploits for the listed vulnerabilities are available. VULNERABILITY CVE-2026-23274 CVE-2026-31659 CVE-2026-31678 CVE-2026-43042 CVE-2026-43074 CVE-2026-43501 CVE-2026-43502 CVE-2026-52912 CVE-2026-52923 CVE-2026-52924 CVE-2026-52929 CVE-2026-52933 CVE-2026-63834 CVE-2026-64560 CVE-2026-68162 CVE-2026-68376 CVE-2026-72137 CVE-2026-72255 CVE-2026-74480 CVE-2026-74581 CVE-2026-74597 CVE-2026-80714

    Post summary

    The text announces CVE-2026-43502 and 20 additional Linux kernel vulnerabilities with technical details and confirms a patch (commit 44b550d88b26 in v7.1-rc3), while noting public exploits exist but are not named specifically.

    0002055
    116 followersView on X

Explore more

Back to dashboard