Exploitation ongoing with high activity in latest observed window (1 mentions)
Immediate actions
Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: Immediate (within 24h)
NVD description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
The br_netfilter fake rtable is embedded in struct net_bridge and is
attached to bridged packets with skb_dst_set_noref(). If such a packet is
queued to NFQUEUE, __nf_queue() upgrades that fake dst with
skb_dst_force().
At that point the queued skb can hold a real dst reference after bridge
teardown has started. The problem is not that every bridged packet needs
its own dst reference. The problem is that NFQUEUE can keep the bridge
private fake dst alive after unregister begins.
Fix this by keeping the bridge fake dst model unchanged and pinning the
bridge master device only while the packet sits in NFQUEUE. Record the
bridge device in nf_queue_entry when the queued skb carries a bridge fake
dst, take a device reference for the queue lifetime, and drop it when the
queue entry is freed.
Also make sure queued entries are reaped when that bridge device goes
down, and drop the redundant nf_bridge_info_exists() test from the fake
dst detection.
This keeps netdev_priv(br->dev) alive until verdict completion, so the
embedded fake rtable and its metrics backing storage cannot be freed out
from under dst_release(). It also avoids the constant refcount bump and
avoids using ipv4-specific dst helpers for IPv6 bridge traffic.
🔴 Nebula Security tarafından, CVE-2026-72255 Use-After-Free açığı için Ubuntu 26.04 / Linux kernel 7.0.0-28 üzerinde çalışan PoC yayınlandı.
Açık, Linux Kernel Netfilter / NFQUEU bileşeninde bulunuyor. Etkisi: LPE
PoC: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-72255-Ubuntu-7.0.0-28
Post summary
Nebula Security released a PoC for CVE‑2026‑72255, a use‑after‑free in Ubuntu 26.04/Linux_kernel 7.0.0‑28’s Netfilter component that allows local privilege escalation, but no active exploitation or patch information is disclosed.
#Analytics#Threat_Research
An analytical review of the main cybersecurity events (Sep 05-12, 2026)
1⃣ Sonicwall SMA1000 Attack https://hunt.io/blog/sonicwall-sma1000-uk-council-attack
// CVE-2026-15409
2⃣ Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://hunt.io/blog/sonicwall-sma1000-uk-council-attack
3⃣ Next Nightmare Eclipse Vulnerability https://github.com/MSNightmare/ShieldCrash/blob/main/README.md
// Microsoft has failed to properly patch ShieldBreak CVE-2026-69414..
4⃣ FortiPAM Vulnerability https://amibeingpwned.com/blog/fortinet-pam-vuln
// CVE-2026-84388
5⃣ Researchers from Nebula Security have disclosed 18 vulnerabilities in the Linux kernel https://www.openwall.com/lists/oss-security/2026/09/08/1
// CVE-2026-80714, CVE-2026-74597, CVE-2026-74581, CVE-2026-74480, CVE-2026-72255, CVE-2026-72137, CVE-2026-68376, CVE-2026-68162, CVE-2026-64560, CVE-2026-63834, CVE-2026-52933, CVE-2026-52929, CVE-2026-52924, CVE-2026-52923, CVE-2026-52912, CVE-2026-43501, CVE-2026-43502, CVE-2026-43074, CVE-2026-43042, CVE-2026-31678, CVE-2026-31659, CVE-2026-23274
6⃣ Netscaler ADC Exploit
7⃣ Critical vulnerabilities in MikroTik RouterOS https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
8⃣ GRAYRABBIT One-click backdoor
// One click. Three critical failures. One backdoor https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou
9⃣ Attacks using browser-in-browser (BiTB) phishing techniques https://www.huntress.com/blog/phishing-bitb-rmm-attacks
🔟 Beltdown: Escaping the Claude Code sandbox https://www.accomplish.ai/blog/beltdown-escaping-the-claude-code-sandbox/
// An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user http://www.Geniebot.pro http://www.cyberpocket.org
Post summary
The post offers a high‑level overview of several high‑profile CVEs and attacks, citing active exploitation and patch gaps but lacking detailed exploit code or PoC specifics.
A new proof‑of‑concept for CVE‑2026‑72255 has been posted, along with a mitigation suggestion (disabling nfnetlink_queue) that is awaiting vendor confirmation.
Researchers disclosed CVE-2026-43502, a Linux kernel local privilege-escalation vulnerability in the RDS zerocopy send path, alongside 20 additional exploitable Linux bugs.
- An unprivileged local user can obtain root privileges without Linux capabilities or user namespaces when required networking, asynchronous I/O, and RDS components are enabled.
- The vulnerability affects kernels from Linux v4.17 and was demonstrated on openSUSE with kernel 6.4.0-150600.23.100.
- The issue was fixed by commit 44b550d88b26, first included in Linux v7.1-rc3; public exploits for the listed vulnerabilities are available.
VULNERABILITY
CVE-2026-23274
CVE-2026-31659
CVE-2026-31678
CVE-2026-43042
CVE-2026-43074
CVE-2026-43501
CVE-2026-43502
CVE-2026-52912
CVE-2026-52923
CVE-2026-52924
CVE-2026-52929
CVE-2026-52933
CVE-2026-63834
CVE-2026-64560
CVE-2026-68162
CVE-2026-68376
CVE-2026-72137
CVE-2026-72255
CVE-2026-74480
CVE-2026-74581
CVE-2026-74597
CVE-2026-80714
Post summary
Researchers disclosed CVE‑2026‑43502, a Linux kernel local privilege escalation affecting kernels from v4.17, and noted it was patched in Linux v7.1‑rc3 (commit 44b550d88b26). Public exploits for the disclosed bugs are reported to be available.
