# NebuSec > Nebu is the AI security platform from NebuSec, combining continuous code and cloud protection with expert vulnerability research. Links below point to Markdown copies of each page: the page URL without its trailing slash plus `.md`, and `/index.md` for the home page. ## Scan a repository for vulnerabilities Nebu scans a GitHub, Git or local repository for exploitable vulnerabilities, verifies each finding, and can generate patches and pull requests. Start from the web app (https://nebusec.ai/help/code-security/start-a-scan.md), the `nebu` CLI, or a coding agent plugin. ```sh npm install -g @nebusec/nebu --force nebu auth login nebu scans run --path . --project --estimate-only nebu scans run --path . --project --max-cost 20 --wait ``` In Claude Code: `claude plugin marketplace add NebuSec/nebu-plugin`, then `claude plugin install nebu-cli@nebusec`. ## Product - [NebuSec](https://nebusec.ai/index.md): NebuSec builds Nebu, an AI security platform for continuous code and cloud protection, backed by researchers who find zero-days in Chrome and Linux. - [About NebuSec](https://nebusec.ai/about.md): Meet the vulnerability researchers behind NebuSec and learn how they build Nebu to protect code, software supply chains, and cloud infrastructure. - [Nebu Code Security](https://nebusec.ai/product/code-security.md): Nebu finds and remediates exploitable vulnerabilities across code, dependencies, containers, and development workflows before they reach production. - [Security at NebuSec](https://nebusec.ai/security.md): Learn how NebuSec protects customer data and systems through technical, personnel, vendor, continuity, and incident-response controls. ## Help: Getting started - [What is Nebu?](https://nebusec.ai/help/getting-started/what-is-nebu.md): An overview of the Nebu platform, the NebuSec team behind it, and which products are available today. - [Onboarding](https://nebusec.ai/help/getting-started/onboarding.md): Choose a service, create your first project, connect a repository, and complete account setup. - [Projects and repositories](https://nebusec.ai/help/getting-started/projects-and-repositories.md): How Nebu organizes repositories, scans, findings, and team access. - [Talking to the NebuSec team](https://nebusec.ai/help/getting-started/talk-to-us.md): How to book a demo or reach us by email. ## Help: Code Security - [Start a scan](https://nebusec.ai/help/code-security/start-a-scan.md): Scan a repository for vulnerabilities: select repositories, choose an audit type and scope, review the fixed quote, and launch. - [Scan options](https://nebusec.ai/help/code-security/scan-options.md): What scan depth, speed, verification, patch, severity, and reuse settings mean. - [Use the Nebu CLI](https://nebusec.ai/help/code-security/nebu-cli.md): Install nebu, sign in, start bounded-cost scans, monitor progress, and work with findings. - [Use the Nebu plugin with ChatGPT, Codex, and Claude](https://nebusec.ai/help/code-security/nebu-plugin.md): Install the NebuSec CLI plugin in terminal or desktop agents, sign in, and run security workflows safely. ## Help: Vulnerability reports - [Opening your report](https://nebusec.ai/help/reports/opening-your-report.md): Report links can only be opened a limited number of times. - [Report link troubleshooting](https://nebusec.ai/help/reports/link-troubleshooting.md): What each error message means, and what to do. - [Sharing a report with your team](https://nebusec.ai/help/reports/sharing-a-report.md): Whether you can forward your link depends on how many times it can be opened. - [Reading a finding](https://nebusec.ai/help/reports/reading-a-finding.md): Each finding starts with a plain summary; the technical detail comes after. - [What we track in reports](https://nebusec.ai/help/reports/report-analytics.md): Only which sections you open, never what you type. ## Research - [Beyond the Model: Benchmarking Codex Security, Claude Security, and Nebu](https://nebusec.ai/research/nebu-benchmark.md): We benchmark our pipeline against Codex Security and Claude Security. Our pipeline gives you a better trade-off: match competing scanners in a fraction of the time and cost, or scale up to find more bugs than either of them. - [Check Your Motor Oil Before Turbocharging: CVE-2026-7899, When V8's Optimization Engine Builds Up Carbon](https://nebusec.ai/research/v8-turboshaft-wasm-phiop-cve-2026-7899.md): In April, we reported a severe vulnerability in V8, the JavaScript and WebAssembly engine used by Chrome. This vulnerability enabled remote code execution in Chrome’s renderer process. This writeup will cover the technical details of the vulnerability. The research was performed with internal tool Mnemosyne, by Project WhatForLunch browser security team at NebuSec, led by @xia0o0o0o and @rcv - [Route of Root: Bring a "DoS only" bug to LPE and bypass the existing patch to win $10,500 in kernelCTF](https://nebusec.ai/research/cve-2026-43501-route-of-root.md): CVE-2023-2156 ("Route of Death") is a Linux kernel vulnerability that was believed to only lead to a DoS attack, and was considered patched in April 2023. However, NebuSec discovered a bypass of the patch and found that it is actually exploitable and can lead to LPE on any Linux distribution that has IPv6 and namespaces enabled. This writeup covers the technical details of the exploit. - [IonStack part III: Rooting Android 17 with GhostLock](https://nebusec.ai/research/ionstack-part-3.md): GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by NebuSec that exists in every major distribution since 2011. After turning it into a stable privilege escalation and container escape, we took one step further and used GhostLock to develop the world’s first public Android 17 root. This writeup covers the additional exploit techniques used to migrate the exploit for Android. - [IonStack Part I: Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT](https://nebusec.ai/research/ionstack-part-1-cve-2026-10702.md): Despite Anthropic Mythos's extensive auditing of Firefox, our agent Nebu still managed to uncover IonBanana, a subtle SpiderMonkey IonMonkey just-in-time miscompilation that can be exploited to achieve arbitrary code execution in the Firefox content process. To our knowledge, this is the first SpiderMonkey JIT CVE after Firefox's last-minute pre-Pwn2Own update, which fixed a large batch of vulnerabilities. We also used it to pwn Tor Browser, showing that even after heavy auditing, JIT compilers still have plenty of places for a banana peel to hide. - [IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years](https://nebusec.ai/research/ionstack-part-2.md): GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebu that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in kernelCTF. This writeup covers the technical details of the exploit. - [Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307](https://nebusec.ai/research/v8-cve-2026-6307-writeup.md): Chrome V8 JavaScript engine features a heap sandbox to prevent an attacker from writing outside of the sandbox region with only a vulnerability in their JavaScript engine. However, Nebu discovered a special bug in the JIT compiler that allows an attacker to gain arbitrary read/write primitives in sandbox and even escape the sandbox to write outside of it solely on its own. This writeup will cover the technical details of the vulnerability. - [How an Omitted Write Barrier in V8 Turns Into RCE in Chrome: CVE-2026-5865](https://nebusec.ai/research/v8-maglev-incorrect-phis-untagging.md): In March, our system detected a severe vulnerability in V8, the JavaScript engine used by Chrome. This vulnerability enabled remote code execution against billions of Chrome users worldwide. - [From a Netfilter Bug to kernelCTF: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10500 Bounty](https://nebusec.ai/research/cve-2026-23274-cos.md): Our AI security research pipeline discovered a critical vulnerability in Linux kernel. This post covers the discovery and exploitation of CVE-2026-23274, a Linux netfilter bug that led to kernelCTF code execution. ## Vulnerability Index - [CVE-2026-43502 — A failed RDS zero-copy send could incorrectly free pinned memory](https://nebusec.ai/buglist/CVE-2026-43502.md): CVE-2026-43502: RDS zero-copy sending pinned user pages before attaching the new message to a socket. If sending failed during that interval, cleanup did not recognize the message as zero-copy and released those user-owned pages with the wrong primitive. Fixed upstream in May 2026. - [CVE-2026-52924 — An SCTP stream update could leave the scheduler pointing at freed memory](https://nebusec.ai/buglist/CVE-2026-52924.md): CVE-2026-52924: When SCTP replaced its output-stream table, it freed the old table but kept a scheduler cursor pointing into it. The next dequeue could follow that stale cursor and manipulate list pointers inside memory that had already been reused. Fixed upstream in June 2026. - [CVE-2026-31678 — An Open vSwitch teardown race could reuse a freed port device](https://nebusec.ai/buglist/CVE-2026-31678.md): CVE-2026-31678: An Open vSwitch port could be detached once by device-unregister handling and then destroyed through another path. The second path cleared and released its device immediately, without waiting for packet readers that had already found the port. Fixed upstream in March 2026. - [CVE-2026-72255 — A queued bridge packet could outlive its private routing data](https://nebusec.ai/buglist/CVE-2026-72255.md): CVE-2026-72255: Bridge netfilter built a private routing object by filling in fields manually rather than using the normal initializer. The object therefore did not hold the bridge device alive when an NFQUEUE packet retained it. Fixed upstream in June 2026. - [PSA-2026-00043-1: Proxmox VE Auth Bypass Exploit](https://nebusec.ai/buglist/PSA-2026-00043-1.md): NebuSec's exploit analysis of the critical PSA-2026-00043-1 authentication bypass affecting EOL Proxmox VE releases, including detection and mitigation. - [CVE-2026-43042 — An MPLS table resize could expose an out-of-bounds route lookup](https://nebusec.ai/buglist/CVE-2026-43042.md): CVE-2026-43042: Linux published the new size of an MPLS route table before publishing the new table itself. A packet arriving in that small window could pass the check for the larger size and then index beyond the end of the old table. Fixed upstream in March 2026. - [CVE-2026-80714 — A late IPVS binding could leave a freed connection in the table](https://nebusec.ai/buglist/CVE-2026-80714.md): CVE-2026-80714: An IPVS connection received through synchronization could be added to the lookup table before it had a destination. If a destination was attached later and marked the connection as “one packet,” expiry freed the object without first removing its existing table entries. Fixed upstream in July 2026. - [CVE-2026-68162 — An SCTP settings write could race a network namespace shutdown](https://nebusec.ai/buglist/CVE-2026-68162.md): CVE-2026-68162: During network namespace shutdown, Linux destroyed SCTP’s internal control socket before removing the settings table that still referred to it. A settings write racing that shutdown could therefore lock and modify a socket that had already been freed. Fixed upstream in July 2026. - [CVE-2026-72137 — A failed XFRM keepalive send could free one packet twice](https://nebusec.ai/buglist/CVE-2026-72137.md): CVE-2026-72137: The XFRM NAT keepalive path could free a network packet after handing ownership of it to the IP transmit code. On error paths where the transmit helper had already consumed the packet, the cleanup code freed the same object a second time. Fixed upstream in July 2026. - [CVE-2026-52933 — A signed io_uring counter could allow two owners at once](https://nebusec.ai/buglist/CVE-2026-52933.md): CVE-2026-52933: An io_uring polling counter stored both a cancellation flag and a reference count in one signed integer. Once the top-bit cancellation flag was set, a signed comparison treated the whole value as negative and skipped the overflow-safe path. Fixed upstream in April 2026. - [CVE-2026-52923 — An overflowing IPC identifier could point at the wrong object](https://nebusec.ai/buglist/CVE-2026-52923.md): CVE-2026-52923: Linux could allocate a System V IPC number just beyond the range its identifier format can represent. The oversized index spilled into the sequence portion of the ID, so the number returned to userspace no longer reliably named the object that had just been created. Fixed upstream in May 2026 and backported by RHEL on August 11. - [CVE-2026-74480 — A multicast leave could leave a freed bridge group reachable](https://nebusec.ai/buglist/CVE-2026-74480.md): CVE-2026-74480: Linux bridge multicast could continue walking through a group after deleting it. Under a particular configuration change, the live group list could still point at an entry already scheduled to be freed. Fixed upstream in July 2026. - [CVE-2026-52912 — A queued bridge packet could outlive the bridge that owned it](https://nebusec.ai/buglist/CVE-2026-52912.md): CVE-2026-52912: A bridge packet sent to an NFQUEUE could keep a pointer to the bridge device without keeping that device alive. Deleting the bridge while the packet waited in userspace left the queued packet pointing at freed kernel memory. Fixed upstream in May 2026. - [CVE-2026-52929 — A failed SCTP stream reset could corrupt the scheduler queue](https://nebusec.ai/buglist/CVE-2026-52929.md): CVE-2026-52929: When an SCTP stream-reset request failed, Linux could remove output streams without fully removing their scheduling records. The scheduler was then left with entries that looked valid but pointed to an empty queue. Fixed upstream in June 2026. - [CVE-2026-74581 — A suppressed IPv6 route could be reused after it was freed](https://nebusec.ai/buglist/CVE-2026-74581.md): CVE-2026-74581: Linux could release an IPv6 route that a policy rule had suppressed, but accidentally leave the result pointing at that route. A later caller could then use the stale pointer after the route was freed. Fixed upstream and backported to Debian Linux 6.12.103. - [CVE-2026-64560 — A process timer could remain queued after its backing object was freed](https://nebusec.ai/buglist/CVE-2026-64560.md): CVE-2026-64560: racing deletion of an armed POSIX process CPU timer with exec from a non-leader thread could free its k_itimer while the timerqueue still referenced it, causing a Linux kernel use-after-free. - [CVE-2026-43074 — An epoll object could be freed while another thread was still using it](https://nebusec.ai/buglist/CVE-2026-43074.md): CVE-2026-43074: a Linux eventpoll object could be freed immediately while an RCU reader still reached it through an epitem, causing a use-after-free. The public Android exploit was validated on a Pixel 10 Pro. - [CVE-2026-43499 — IonStack part II: GhostLock, a 15-year rtmutex/futex-PI stack use-after-free, from unprivileged syscalls to root](https://nebusec.ai/buglist/CVE-2026-43499.md): IonStack part II: GhostLock, a 15-year rtmutex/futex-PI stack use-after-free, from unprivileged syscalls to root (kernel/locking/rtmutex.c · remove_waiter) - [CVE-2026-43501 — Route of Death patch bypass: an intermediate-hop RPL wrap gives a remote OOB write and Linux LPE](https://nebusec.ai/buglist/CVE-2026-43501.md): Route of Death patch bypass: an intermediate-hop RPL wrap gives a remote OOB write and Linux LPE (net/ipv6/exthdrs.c · ipv6_rpl_srh_rcv) - [CVE-2026-6307 — JS-to-Wasm FrameState merging breaks V8 sandbox boundaries](https://nebusec.ai/buglist/CVE-2026-6307.md): JS-to-Wasm FrameState merging breaks V8 sandbox boundaries (src/compiler/frame-states.cc · FrameStateFunctionInfo::operator==) - [CVE-2026-5865 — Maglev phi retagging bug causes exploitable write barrier omission](https://nebusec.ai/buglist/CVE-2026-5865.md): Maglev phi retagging bug causes exploitable write barrier omission (src/maglev/maglev-phi-representation-selector.cc · EnsurePhiInputsTagged) - [CVE-2026-23274 — Netfilter idletimer use-before-initialization leads to control-flow hijack](https://nebusec.ai/buglist/CVE-2026-23274.md): Netfilter idletimer use-before-initialization leads to control-flow hijack (net/netfilter/xt_IDLETIMER.c · idletimer_tg_checkentry) - [CVE-2026-42530 — HTTP/3 QPACK encoder stream reopen triggers a use-after-free in the NGINX worker](https://nebusec.ai/buglist/CVE-2026-42530.md): HTTP/3 QPACK encoder stream reopen triggers a use-after-free in the NGINX worker (ngx_http_v3_module · QPACK encoder stream)