TyphoonPWN lists up to $70,000 for Linux privilege escalation, and Google's kernelCTF pays a fixed $71,337 per eligible exploit. Pwn2Own Berlin, set for May 14, adds AI categories and more than $1,000,000 in prizes.

OpenAIはAIによるLinuxカーネルの脆弱性調査で2,308件の候補を発見し、1,724件を再現、948件でroot権限への昇格を実証。修正案の自動生成、API費用約121万ドル、kernelCTFでの検証と企業のLinux管理への影響を一次ソースから解説

TL;DR Security researchers have publicly disclosed technical details and working proof-of-concept (PoC) exploit code for a high-severity Linux kernel vulnerability. Tracked as CVE-2026-31419 with a CVSS v3.1 score of 7.8, the flaw allows local attackers to elevate privileges to root. System administrators should apply the latest upstream kernel updates immediately to protect multi-tenant systems. Why It Matters Linux powers more than 90 percent of public cloud workloads and millions of enterprise servers globally, according to industry estimates.

Google's kernelCTF program has published full technical details and a working proof-of-concept exploit for CVE-2026-23111. This Linux nf_tables vulnerability is a use-after-free bug in the kernel's Netfilter packet filter. A local attacker can use it to gain root and escape a container. Red Hat rates the flaw 7.8 (High) on the CVSS scale. TL;DR A one-character logic error lets an attacker drain a chain's reference count.

TL;DR A full write-up and exploit are now public for CVE-2026-23074, a Linux kernel privilege escalation flaw in the teql traffic-control scheduler. The use-after-free dates back to Linux 2.6.12, the start of the kernel's Git history in 2005. Researchers used it to gain root and escape a container on Google's Container-Optimized OS in the kernelCTF program. Why It Matters The bug survived in the kernel's networking code for about two decades.

TL;DR Full technical details and a working exploit are now public for CVE-2026-43501, a Linux kernel IPv6 vulnerability rated CVSS 9.8 by the kernel's CVE team. The out-of-bounds write sits in the RPL source routing header code. Researchers used it to escape a container on Google's Container-Optimized OS (COS) in the kernelCTF program. Why It Matters The bug lives in the kernel's IPv6 receive path, which has existed since Linux 5.7.

弊社エンジニアがGoogle kernelCTFを0-dayで突破しました。kCFI+IBT、SLAB_VIRTUAL、KMALLOC_PARTITION_TYPEDなどのセキュリティ緩和策が有効化され、io_uring、user_ns、TLSも潰された新ターゲットです。対象の報奨金は$71,337で、日本人初です！

How a missed x86 TLB shootdown became page-table control in Google kernelCTF.

How a missed x86 TLB shootdown became page-table control in Google kernelCTF.

Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 9...

Linuxカーネルで2011年から存在していた脆弱性が明らかになった。特別な権限を必要とせず、一般ユーザー権限から権限昇格やコンテナ脱出につながる可能性があるという。GoogleのkernelCTFでも高く評価された攻撃は、どのような仕組みで成立するのか。

A tale about exploiting KernelCTF Mitigation, Debian, and Ubuntu instances with a double-free in nf_tables in the Linux kernel, using novel techniques like Dirty Pagedirectory. All without even having...

Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 9...

CVE-2025-38001 is a Use-After-Free vulnerability in the Linux network packet scheduler, specifically in the HFSC queuing discipline. When the HFSC qdisc is utilized with NETEM and NETEM packet duplica...

CVE-2025-38001 is a Use-After-Free vulnerability in the Linux network packet scheduler, specifically in the HFSC queuing discipline. When the HFSC qdisc is utilized with NETEM and NETEM packet duplica...