Loading vulnerability…
CVE-2026-68138 is a race condition in the Linux kernel net/sched subsystem affecting qdisc rate table management. The flaw arises because qdisc_get_rtab() and qdisc_put_rtab() modify the process-global qdisc_rtab_list and a non-atomic reference counter without synchronization. This behavior was historically safe only because callers held the RTNL mutex, but that assumption no longer holds for certain traffic control paths, including cls_flower filter creation with police actions operating without RTNL serialization. Concurrent RTM_NEWTFILTER requests on different CPUs can therefore race while inserting, referencing, or freeing the same struct qdisc_rate_table entry. The resulting memory safety failure can trigger use-after-free and double-free conditions in kernel memory.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
Repository contains a real local privilege-escalation exploit for CVE-2026-68138, a Linux kernel race in qdisc rate-table handling reachable through unlocked flower/police traffic-control paths. The main code is in exploit.c, a standalone C PoC for upstream-style vulnerable kernels. It creates user and network namespaces, races RTM_NEWTFILTER/flower-related operations to obtain a use-after-free/double-free on struct qdisc_rate_table, then pivots into a classic-BPF object overlap. From there it performs heap reclaim and corruption to reach a modprobe-based privilege escalation path. The main variant appears to reclaim with pipe-ring and xattr objects, leak pipe_buffer metadata, target /sbin/modprobe page-cache state, and then trigger helper execution for a root shell. A second major code path exists in ubuntu/exploit-5.15.0-187.c. This is a build-specific Ubuntu 22.04.5 exploit variant for linux-image-5.15.0-187-generic. Because Ubuntu’s allocator/accounting behavior differs, it uses a different reclaim chain: reclaim freed BPF memory with simple_xattr objects in the user’s cgroup-v2 subtree, leak xattr pointers via SO_GET_FILTER, free the live xattr through the dangling BPF reference, reclaim with blocking select() bitmaps, forge linked-list pointers, overwrite modprobe_path with /tmp/x, verify via /proc/sys/kernel/modprobe, and trigger module autoload to execute a helper that opens an initial-namespace root shell. Supporting files are mostly lab and reproducibility infrastructure: build.sh and ubuntu/build.sh compile static binaries; config.fragment documents kernel options for the upstream lab; docs/ contains successful output transcripts; scripts/live-demo.exp and scripts/record-live.sh automate a live QEMU demonstration; ubuntu/lab/prepare.sh, first-boot.sh, run-attempts.exp, meta-data, and user-data build and run a disposable Ubuntu cloud-image lab with required modules, serial autologin, raised RLIMIT_NOFILE, and nokaslr. README.md and ubuntu/README.md thoroughly document affected versions, exploit conditions, and reproduction steps. Overall purpose: provide a proof-of-concept but operational exploit chain demonstrating conversion of the qdisc race into initial-namespace root on vulnerable Linux kernels, with a generic upstream PoC and a tightly constrained Ubuntu-specific variant.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.