Local Network Admin Privilege Can Lead to Root Takeover via New Linux Kernel Flaw

A newly disclosed vulnerability in the Linux kernel, cataloged as CVE-2026-72018, enables a local attacker who already possesses the CAP_NET_ADMIN capability to elevate privileges to the root level. The flaw stems from an out-of-bounds write error in the Shared Memory Communications Direct (SMC‑D) DIBS loopback code, a component used for high‑performance intra‑host communication.

The issue was initially reported by the security research collective GBHackers, who highlighted the severity of the bug and its potential impact on a wide range of Linux‑based systems. Because the exploit requires only the CAP_NET_ADMIN capability—a permission commonly granted to network management tools and container runtimes—the attack surface includes many server environments, cloud instances, and embedded devices that rely on standard networking stacks.

Kernel developers note that the out-of-bounds write occurs when the SMC‑D implementation mishandles memory buffers during loopback operations. By carefully crafting data that triggers the faulty write, an attacker can overwrite adjacent kernel structures, ultimately gaining unrestricted code execution. The vulnerability has been rated as high severity, reflecting both the ease of exploitation for privileged locals and the full system compromise it enables.

Linux distribution maintainers have already begun preparing patches, and the kernel maintainers plan to backport fixes to supported long‑term releases. Administrators are advised to monitor official security advisories and apply updates as soon as they become available. In the interim, reducing the assignment of CAP_NET_ADMIN to only essential processes and employing mandatory access control frameworks such as SELinux or AppArmor can help mitigate exposure.

The discovery underscores the ongoing challenges of securing the kernel’s complex code base, especially as new communication mechanisms like SMC‑D are integrated to meet performance demands. As the patches roll out, the security community will likely examine whether related code paths contain similar memory‑handling weaknesses, aiming to prevent comparable escalation vectors from emerging in future kernel revisions.