VulnSocial

CVE-2026-80714PoC

HIGHCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bind_dest() copies connection flags from the destination into cp->flags. IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed, expiry can treat it as a one-packet connection and skip unlinking the existing conn_tab node, leaving stale hash nodes pointing at a freed struct ip_vs_conn. Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced connections.

Back to dashboard
7.5/ 10 priority

Sources & remediation

Other references

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 8 mentions across 5 observed days

What's happening

  • Active exploitation reported across 1 signal
  • Exploit tool or code specified in 3 signals
  • PoC mentioned or linked in 5 signals
  • Patch or workaround mentioned in 5 signals
  • Technical details provided in 6 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 3 mentions (2026-09-03); latest day: 1
  • 8 total mentions across 5 days

Deep dive

Activity timeline8 mentions / 5d
01223Mentions · 2026-08-28: 1Mentions · 2026-08-31: 2Mentions · 2026-09-03: 3Mentions · 2026-09-12: 1Mentions · 2026-09-15: 1PoC Mentioned / Linked · 2026-08-31: 2PoC Mentioned / Linked · 2026-09-03: 3Exploit Tool / Code · 2026-08-31: 2Exploit Tool / Code · 2026-09-03: 1Active Exploitation · 2026-09-12: 1Patch / Workaround · 2026-08-31: 2Patch / Workaround · 2026-09-03: 2Patch / Workaround · 2026-09-15: 1Technical Details · 2026-08-31: 2Technical Details · 2026-09-03: 3Technical Details · 2026-09-15: 108-2808-3109-0309-1209-15
Signal classification5 categories
PoC
450.0%
Disclosure
112.5%
Exploit
112.5%
Active Exploitation
112.5%
Patch
112.5%
Referenced assets13 URLs
By indicator
Classification over time
DateTotalLabels
2026-08-281
Disclosure1
2026-08-312
Exploit1PoC1
2026-09-033
PoC3
2026-09-121
Active Exploitation1
2026-09-151
Patch1
Full discourse8 posts
  • Cyber Meowfia@cybermeowfia
    Exploit

    Today's exploit is for the latest Debian, a UAF in netfilter: CVE-2026-80714. It was introduced in Jul 2010 and fixed upstream in Jul 2026. Discovered and exploited by the NebuSec security pipeline. Exp source code: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-80714-Debian-6.12.101 https://t.co/jZ3QkY6PX6

    Post summary

    The post shares exploit source code for CVE-2026-80714, a use-after-free in netfilter affecting Debian, noting it was fixed upstream in July 2026.

    02021194311.3K
    439 followersView on X
  • yousukezan@yousukezan
    PoC

    LinuxカーネルのIPVSに、ローカルユーザーからroot権限昇格につながる脆弱性「CVE-2026-80714」が見つかった。NebuSecは最新Debianで動作するPoCと動画を公開しており、実際の悪用はまだ確認されていない。 問題はIP Virtual Serverのuse-after-freeで、同期接続が宛先作成前に生成された後、後から宛先へ結び付ける際にone-packetフラグを誤って継承することで発生する。期限切れ処理でハッシュノードの解除が省かれ、解放済み接続オブジェクトへのポインタが残るという。 NebuSecのPoCは、このメモリ破壊からroot権限昇格に到達できることを示した。脆弱性は2010年7月に導入され、2026年7月にupstreamで修正された。IPVSを有効にした長期間のカーネルが影響を受ける。 修正では同期接続をバインドする際にone-packetフラグを引き継がないよう変更した。影響環境では修正版カーネルへの更新と再起動が必要で、更新が遅れる場合はローカルアクセス制限とIPVS設定権限の制限が挙げられている。 https://securityonline.info/linux-kernel-cve-2026-80714-root-escalation/

    Post summary

    CVE‑2026‑80714 is a Linux kernel IPVS use‑after‑free that allows local users to gain root access; NebuSec released a PoC and video, no active exploitation has been observed, and an upstream patch is available with recommended updates and mitigations.

    0502753.1K
    16.1K followersView on X
  • Rıdvan Yağlı@ridvanyagli
    PoC

    🔴 Nebula Security tarafından, Linux Kernel CVE-2026-80714 Use-After-Free açığı için Debian 6.12.101 üzerinde çalışan bir PoC yayınlandı. Açık, Linux Kernel / IPVS bileşeninde bulunuyor. Etkisi: Kernel crash / DoS Özellikle IPVS kullanan Debian sistemlerinde kernel sürümünün kontrol edilmesi ve mevcut güvenlik güncellemelerinin uygulanması öneriliyor. PoC: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-80714-Debian-6.12.101

    Post summary

    Nebula Security released a PoC for CVE‑2026‑80714 on Debian 6.12.101, detailing a use‑after‑free that crashes the kernel, and recommends applying security updates.

    121641.6K
    2.4K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    PoC

    CVE-2026-80714 (CVSS 9.8) is a Linux kernel IPVS use-after-free. Public PoC code and a demo video show root privilege escalation on Debian. Patch now. #Linux #CVE202680714 #PrivilegeEscalation #KernelBug #IPVS #InfoSec #UseAfterFree https://securityonline.info/linux-kernel-cve-2026-80714-root-escalation/

    Post summary

    The post announces CVE-2026-80714, a Linux kernel IPVS use‑after‑free with CVSS 9.8, and highlights publicly available PoC code and a demo video that demonstrate root privilege escalation, noting that a patch has been released.

    03071536
    13.0K followersView on X
  • Mr. OS@ksg93rd
    Active Exploitation

    #Analytics #Threat_Research An analytical review of the main cybersecurity events (Sep 05-12, 2026) 1⃣ Sonicwall SMA1000 Attack https://hunt.io/blog/sonicwall-sma1000-uk-council-attack // CVE-2026-15409 2⃣ Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://hunt.io/blog/sonicwall-sma1000-uk-council-attack 3⃣ Next Nightmare Eclipse Vulnerability https://github.com/MSNightmare/ShieldCrash/blob/main/README.md // Microsoft has failed to properly patch ShieldBreak CVE-2026-69414.. 4⃣ FortiPAM Vulnerability https://amibeingpwned.com/blog/fortinet-pam-vuln // CVE-2026-84388 5⃣ Researchers from Nebula Security have disclosed 18 vulnerabilities in the Linux kernel https://www.openwall.com/lists/oss-security/2026/09/08/1 // CVE-2026-80714, CVE-2026-74597, CVE-2026-74581, CVE-2026-74480, CVE-2026-72255, CVE-2026-72137, CVE-2026-68376, CVE-2026-68162, CVE-2026-64560,  CVE-2026-63834, CVE-2026-52933, CVE-2026-52929, CVE-2026-52924, CVE-2026-52923, CVE-2026-52912, CVE-2026-43501, CVE-2026-43502, CVE-2026-43074, CVE-2026-43042, CVE-2026-31678, CVE-2026-31659, CVE-2026-23274 6⃣ Netscaler ADC Exploit 7⃣ Critical vulnerabilities in MikroTik RouterOS https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ 8⃣ GRAYRABBIT One-click backdoor // One click. Three critical failures. One backdoor https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou 9⃣ Attacks using browser-in-browser (BiTB) phishing techniques https://www.huntress.com/blog/phishing-bitb-rmm-attacks 🔟 Beltdown: Escaping the Claude Code sandbox https://www.accomplish.ai/blog/beltdown-escaping-the-claude-code-sandbox/ // An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user http://www.Geniebot.pro http://www.cyberpocket.org

    Post summary

    The post lists multiple current security incidents, highlighting several CVEs that are either being actively exploited in the wild or associated with known attacks, but it does not provide PoC code, patches, or detailed technical descriptions.

    01052601
    3.4K followersView on X
  • Threat Landscape@LandscapeThreat
    Patch

    Researchers disclosed CVE-2026-43502, a Linux kernel local privilege-escalation vulnerability in the RDS zerocopy send path, alongside 20 additional exploitable Linux bugs. - An unprivileged local user can obtain root privileges without Linux capabilities or user namespaces when required networking, asynchronous I/O, and RDS components are enabled. - The vulnerability affects kernels from Linux v4.17 and was demonstrated on openSUSE with kernel 6.4.0-150600.23.100. - The issue was fixed by commit 44b550d88b26, first included in Linux v7.1-rc3; public exploits for the listed vulnerabilities are available. VULNERABILITY CVE-2026-23274 CVE-2026-31659 CVE-2026-31678 CVE-2026-43042 CVE-2026-43074 CVE-2026-43501 CVE-2026-43502 CVE-2026-52912 CVE-2026-52923 CVE-2026-52924 CVE-2026-52929 CVE-2026-52933 CVE-2026-63834 CVE-2026-64560 CVE-2026-68162 CVE-2026-68376 CVE-2026-72137 CVE-2026-72255 CVE-2026-74480 CVE-2026-74581 CVE-2026-74597 CVE-2026-80714

    Post summary

    The text discloses CVE-2026-43502 as a Linux kernel local privilege-escalation bug and lists multiple related CVEs, but its main actionable item is that the issue was fixed by commit 44b550d88b26 in Linux v7.1-rc3. It notes public exploits are available, but does not name a specific exploit tool or report active exploitation.

    0002055
    120 followersView on X
  • moton@moton
    PoC

    CVE-2026-80714 (CVSS 9.8): Linux Root Escalation PoC Out - https://securityonline.info/linux-kernel-cve-2026-80714-root-escalation/

    Post summary

    The post announces that a Proof of Concept for the high‑severity CVE‑2026‑80714 root‑escalation flaw is available at the provided link, but does not discuss active exploitation or mitigation.

    0000098
    756 followersView on X
  • VulDB 🛡@vuldb
    Disclosure

    The severity is increased for this new vulnerability affecting Linux Kernel (CVE-2026-80714) https://vuldb.com/vuln/396644

    Post summary

    The text announces that the severity of a new Linux Kernel vulnerability, CVE‑2026‑80714, has been increased, with a reference to a vuldb.com record.

    00000141
    2.3K followersView on X

Explore more

Back to dashboard