{"vulnerability": "CVE-2026-72137", "sightings": [{"uuid": "d86c6a12-5bc1-4005-82ae-b28a6c5fa2ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72137", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtb7pllmey2j", "content": "CVE-2026-72137 - linux\nA Linux kernel vulnerability has been fixed that could cause a double free error when sending data over IPv4 or IPv6. This issue was resolved to prevent potential crashes. Linux users should\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#linux #CVE #infosec", "creation_timestamp": "2026-08-17T07:50:05.883204Z"}, {"uuid": "0bf5d9b6-8797-4875-9a68-60422250797a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72137", "type": "seen", "source": "https://infosec.exchange/users/obivan/statuses/117167528441807422", "content": "Another Linux LPE https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-72137-ubuntu-7.0.0-28", "creation_timestamp": "2026-08-27T12:43:21.853921Z"}, {"uuid": "e4718662-78e6-40b8-ae44-ccf90717084c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72137", "type": "seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mu2ure4kwfg2", "content": "Another Linux LPE https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-72137-ubuntu-7.0.0-28", "creation_timestamp": "2026-08-27T12:43:33.547563Z"}, {"uuid": "5d2a6051-f8df-43aa-9a5d-31885b94c086", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72137", "type": "seen", "source": "https://infosec.exchange/users/decio/statuses/117167824894388556", "content": "Le kernel #Linux avait d\u00e9j\u00e0 free().Avec CVE-2026-72137, il propose maintenant le double free. :apartyblobcat: :neocat_floof_explode: \nEt CyberMeowfia  (nebusec.ai) vient de publier le PoC \u00ab root inclus \u00bb pour #Ubuntu  7.0.0-28.\u2b07\ufe0f LPE exploit for the latest Ubuntu 26.04 ( https://lnkd.in/p/eYP7_A2g ) \ud83d\udc40 \ud83d\udc47 https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-72137-ubuntu-7.0.0-28\nBref, si ce kernel tra\u00eene chez vous : patcher avant que quelqu\u2019un ne profite de la promo 2 pour 1.\n#CyberVeille #CVE_2026_72137", "creation_timestamp": "2026-08-27T13:58:45.582320Z"}, {"uuid": "c471f44a-9513-4d70-b87b-d7fac5dc72dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72137", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mtzwhpxnee2k", "content": "A public PoC exploit targets CVE-2026-72137, a CVSS 9.8 Linux kernel double-free that enables root privilege escalation. Patch now.\n\n#CVE202672137 #LinuxKernel #PrivilegeEscalation #PoC #xfrm #InfoSec", "creation_timestamp": "2026-08-27T03:41:12.360629Z"}, {"uuid": "cfbc73e9-5334-44f6-aa0e-630451775cd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72137", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mu2ljel7re2h", "content": "CVE-2026-72137 is trending. Hype score 9, currently #3 on cvemon.\n\nIn the Linux kernel, the following vulnerability has been resolved: xfrm: nat_keepalive: avoid double free on send error nat_keepalive_send() frees the keepalive skb whenever the IPv4\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-72137", "creation_timestamp": "2026-08-27T09:57:55.612619Z"}, {"uuid": "a8b2dd15-daa5-46e4-8e0f-c48be55f4de4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72137", "type": "seen", "source": "https://t.me/bdufstecru/3421", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 nat_keepalive_send() \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 xfrm \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043e\u0434\u043d\u043e\u0433\u043e \u0438 \u0442\u043e\u0433\u043e \u0436\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u0438\u043b\u0438 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-13147\nCVE-2026-72137\n\n\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://git.kernel.org/stable/c/226f4a490d1a938fc838d8f8c46a4eca864c0d78\nhttps://git.kernel.org/stable/c/5b0c4c916f202b8fd13d12afb6af62b385622f81\nhttps://git.kernel.org/stable/c/a8a7e6a9ff8a4c1f067694ddbd44be67fdf36693\nhttps://git.kernel.org/stable/c/d0a4dc7efa825bce60a8da8f7d43c864a159abde\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2026-72137\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Ubuntu:\nhttps://ubuntu.com/security/CVE-2026-72137", "creation_timestamp": "2026-08-31T18:00:04.234882Z"}, {"uuid": "6f9103ca-b606-4e30-bc42-3bae81ba9a3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72137", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3421", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 nat_keepalive_send() \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 xfrm \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043e\u0434\u043d\u043e\u0433\u043e \u0438 \u0442\u043e\u0433\u043e \u0436\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u0438\u043b\u0438 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-13147\nCVE-2026-72137\n\n\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://git.kernel.org/stable/c/226f4a490d1a938fc838d8f8c46a4eca864c0d78\nhttps://git.kernel.org/stable/c/5b0c4c916f202b8fd13d12afb6af62b385622f81\nhttps://git.kernel.org/stable/c/a8a7e6a9ff8a4c1f067694ddbd44be67fdf36693\nhttps://git.kernel.org/stable/c/d0a4dc7efa825bce60a8da8f7d43c864a159abde\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2026-72137\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Ubuntu:\nhttps://ubuntu.com/security/CVE-2026-72137", "creation_timestamp": "2026-09-01T00:00:09.105029Z"}, {"uuid": "0cbedf3b-3d35-416f-91b6-e58f6a5d37f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72137", "type": "seen", "source": "https://t.me/HackingTeamGrupoOfficial/48676", "content": "CVE-2026-72137 ubuntu-7.0.0-28  LPE\n*\nexploit", "creation_timestamp": "2026-09-02T06:00:05.352234Z"}, {"uuid": "9c2ba94b-fcc5-48f2-a718-d3d46d4e1d75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72137", "type": "seen", "source": "https://bsky.app/profile/rockylinux.org/post/3mukbs27vzf2r", "content": "We've released an updated kernel (6.12.0-211.50.1.el10_2.0.1 - available in our security repo) that fixes two LPE CVEs, CVE-2026-72137 and CVE-2026-53361. \n\n(You can enable the security repo with `sudo dnf --enablerepo=security update`)\n\nOnce again, thanks to CIQ engineers who provided the fix!", "creation_timestamp": "2026-09-02T15:46:25.192046Z"}, {"uuid": "5ff3e733-416c-444a-a357-8ac5b6f7524f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72137", "type": "seen", "source": "https://t.me/proxy_bar/3614", "content": "CVE-2026-72137 ubuntu-7.0.0-28  LPE\n*\nexploit", "creation_timestamp": "2026-09-02T18:00:05.739416Z"}, {"uuid": "47ad3c33-f9e9-4d0e-9139-d070224ca657", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72137", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/3614", "content": "CVE-2026-72137 ubuntu-7.0.0-28  LPE\n*\nexploit", "creation_timestamp": "2026-09-03T00:00:40.346380Z"}, {"uuid": "ba0395e2-7e80-47e3-a7e7-4b58dab50b92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72137", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/48676", "content": "CVE-2026-72137 ubuntu-7.0.0-28  LPE\n*\nexploit", "creation_timestamp": "2026-09-03T00:00:53.558546Z"}, {"uuid": "a2e1b896-e448-4246-9baa-1751c6b801b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72137", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20261002", "content": "", "creation_timestamp": "2026-10-01T18:00:00.000000Z"}, {"uuid": "4d3389d1-6687-4ba7-ae6f-3f6e31664311", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72137", "type": "seen", "source": "https://gist.github.com/alon710/1f27b9da2e1bcf7c04287c9ec4420dba", "content": "# CVE-2026-72137: CVE-2026-72137: Double Free in Linux Kernel XFRM NAT Keepalive\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-08-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72137\n\n## Summary\nCVE-2026-72137 is a critical double-free vulnerability in the Linux kernel's XFRM (IPsec) subsystem. The vulnerability occurs when the kernel attempts to send NAT keepalive packets over UDP. Under specific transmission failure conditions, both the downstream networking stack and the upstream keepalive dispatcher attempt to free the same socket buffer (sk_buff) structure, leading to kernel memory corruption, denial of service, or potential local privilege escalation.\n\n## TL;DR\nA double-free vulnerability in the Linux kernel XFRM subsystem allows error-handling paths to release a socket buffer twice, causing kernel crashes or potential local privilege escalation.\n\n## Technical Details\n\n- **CWE ID**: CWE-415 (Double Free)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.8 (Critical)\n- **EPSS Score**: 0.00671 (Percentile: 50.32%)\n- **Exploit Status**: None (No public exploit available)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Linux Kernel versions 6.11 through 6.12.100\n- Linux Kernel versions 6.13 through 6.18.39\n- Linux Kernel versions 6.19 through 7.1.4\n- **Linux Kernel**: [6.11.0, 6.12.101) (Fixed in: `6.12.101`)\n- **Linux Kernel**: [6.13.0, 6.18.40) (Fixed in: `6.18.40`)\n- **Linux Kernel**: [6.19.0, 7.1.5) (Fixed in: `7.1.5`)\n\n## Mitigation\n\n- Upgrade the Linux kernel to patched versions (6.12.101, 6.18.40, 7.1.5, or higher).\n- Disable UDP encapsulation of IPsec (NAT-Traversal) if not required, to prevent NAT keepalive generation.\n- Restrict the CAP_NET_ADMIN capability for untrusted local users and containers to block route and interface manipulation.\n\n**Remediation Steps:**\n1. Identify the running kernel version using 'uname -r'.\n2. Apply updates from your distribution's package manager to acquire the patched kernel version.\n3. Reboot the host to apply the new kernel.\n4. Verify that XFRM NAT keepalives are disabled or running on a patched kernel.\n\n## References\n\n- [Official NVD Registry](https://nvd.nist.gov/vuln/detail/CVE-2026-72137)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-72137)\n- [Kernel Mainline Patch](https://git.kernel.org/stable/c/226f4a490d1a938fc838d8f8c46a4eca864c0d78)\n- [Wiz Vulnerability Database Listing](https://www.wiz.io/vulnerability-database/cve/cve-2026-72137)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72137) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T10:00:32.000000Z"}]}