# NUMEROUS kernel exploits and vulnerabilities **URL:** \ **Category:** For Developers\ **Created:** [November 5, 2026, 8:39pm UTC](https://forum.openwrt.org/t/numerous-kernel-exploits-and-vulnerabilities/255231 "2026-11-05T20:39:51Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![timur.davletshin](https://forum.openwrt.org/user_avatar/forum.openwrt.org/timur.davletshin/32/24859_2.png) [@timur.davletshin](https://forum.openwrt.org/u/timur.davletshin)\ **Post date:** [November 5, 2026, 8:39pm UTC](https://forum.openwrt.org/t/numerous-kernel-exploits-and-vulnerabilities/255231/1 "2026-11-05T20:39:51Z")
FYI: > **[A thousand fewer paths to root](https://openai.com/index/a-thousand-fewer-paths-to-root/)** > > OpenAI built an autonomous pipeline that found, validated, and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel. ---
**Author:** ![dave14305](https://forum.openwrt.org/user_avatar/forum.openwrt.org/dave14305/32/26290_2.png) [@dave14305](https://forum.openwrt.org/u/dave14305)\ **Post date:** [November 5, 2026, 9:36pm UTC](https://forum.openwrt.org/t/numerous-kernel-exploits-and-vulnerabilities/255231/5 "2026-11-05T21:36:06Z")
When I already login locally as root on my router, what local privilege escalation remains to be exploited? Should I change my own password? 😀 ---
**Author:** ![flygarn12](https://forum.openwrt.org/user_avatar/forum.openwrt.org/flygarn12/32/57396_2.png) [@flygarn12](https://forum.openwrt.org/u/flygarn12)\ **Post date:** [November 5, 2026, 11:16pm UTC](https://forum.openwrt.org/t/numerous-kernel-exploits-and-vulnerabilities/255231/6 "2026-11-05T23:16:52Z")
To be honest when looking at all these cyber hacking things going on nowadays, to this day using any meaningful password at all seems to be the biggest obstacle for the criminal activities. The other break in to networks seems to be more of a Connect-as-a-paid-service without any security than actual qualified hacking. So the old defence tactic still applies in cyber, just make the obstacle bigger on your things than the neighbor thing, then you are left alone… It was like when I started using OpenVPN with the official standard port of 1194 the dos attacks was never ending and the intrusion attempts was almost daily after a year. Just use another non official “secret” port and no one has touch the VPN tunnel again over almost 10years. And do not connect your fridge to the internet, if you want to eat! ---
**Author:** ![flygarn12](https://forum.openwrt.org/user_avatar/forum.openwrt.org/flygarn12/32/57396_2.png) [@flygarn12](https://forum.openwrt.org/u/flygarn12)\ **Post date:** [November 5, 2026, 11:23pm UTC](https://forum.openwrt.org/t/numerous-kernel-exploits-and-vulnerabilities/255231/7 "2026-11-05T23:23:31Z")
When i do a simple wifi scan in the apartment building there are a lot of wifi signals as expected in a normal apartment building. But only my wifi is wpa3. Most use wpa2. There are also some still using WEP!? Almost half of the SSID is obviously the manufacturer standard wifi names, on these routers I simply guess they also use the standard password. There are also some web cams with more or less manufacturers name in the SSID… And everyone drive the tx power to max so the ssid is visible faaaar away, instead of setting the tx power so the wifi signal stop just outside the wall. ---
**Author:** ![psherman](https://forum.openwrt.org/letter_avatar/psherman/32/5_5575768a8748004e209b776fc1b2916d.png) [@psherman](https://forum.openwrt.org/u/psherman)\ **Post date:** [November 6, 2026, 3:29am UTC](https://forum.openwrt.org/t/numerous-kernel-exploits-and-vulnerabilities/255231/8 "2026-11-06T03:29:09Z")
Per @dave14305 's comments, it seems to me that LPE vulnerabilities are rarely a concern on OpenWrt which is typically used as a single-user (root only) environment. With that in mind, a useful 'filter' for this type of exploit is: - Is OpenWrt vulnerable to _unathenticated_ attacks - For the (relatively small) population of setups that are actually multi-user, does a given vulnerability apply - Are any other services (say SMB, etc.) that service multiple users implicated in potential privilege escalations. ---
**Author:** ![eginnc](https://forum.openwrt.org/letter_avatar/eginnc/32/5_5575768a8748004e209b776fc1b2916d.png) [@eginnc](https://forum.openwrt.org/u/eginnc)\ **Post date:** [November 6, 2026, 10:46am UTC](https://forum.openwrt.org/t/numerous-kernel-exploits-and-vulnerabilities/255231/9 "2026-11-06T10:46:44Z")
> [@flygarn12](#): > > using any meaningful password Regarding the single user root password barrier, it wasn't too long ago that OpenWrt hashed the root password with just md5crypt in the shadow file. It took a good password to compensate for that. The default linux password hash was upgraded from md5crypt to ~8X slower sha512crypt around 2008. By the time OpenWrt upgraded its default md5crypt to just ~4X slower sha256crypt 14 years later with 22.03, linux had abandoned sha512crypt for yescrypt to keep up with brute force threats. I get it - no one wants to twiddle their thumbs while a slow router MIPS CPU struggles through computing a hash at every login. But I do think it's worth keeping in mind that a meaningful OpenWrt root password should probably have more bits of entropy than a meaningful default linux password. > [@flygarn12](#): > > But only my wifi is wpa3. Most use wpa2. Too many of our home network clients don't work with WPA3, so count me in with the WPA2 (forced AES) Luddites. Between main home, IOT and Guest SSID's on their own segregated VLANs and truly random high bit pass phrases on all SSIDs, I've gotten over it. WPA3 would be better, but I'm not losing sleep at night worrying about an inside attacker with pass phrase knowledge intercepting WPA2 WiFi traffic encrypted with https going back and forth from my bank, etc. Like you though, I do see the same in our WiFi neighborhood. Default vendor SSID names susceptible to rainbow table attack (if they are not already using default vendor passwords or something clever like "Password123" 😀 ), no client type segregation to different SSIDs and yes, even WEP. ---
**Author:** ![hex](https://forum.openwrt.org/letter_avatar/hex/32/5_5575768a8748004e209b776fc1b2916d.png) [@hex](https://forum.openwrt.org/u/hex)\ **Post date:** [November 6, 2026, 12:44pm UTC](https://forum.openwrt.org/t/numerous-kernel-exploits-and-vulnerabilities/255231/10 "2026-11-06T12:44:09Z")
Contrary to the prevailing view in this thread, I do think that LPEs have some relevance even for OpenWrt. Most of us log in as root, but there are also service accounts set up by default, `/etc/shadow` in `base-files` lists 4 accounts: root, daemon, network, nobody. Should we worry? Not too much, but I don't think being complacent is wise either. If there exists a vulnerability which allows someone to gain access as nobody, LPE would just escalate the access to root. I'm not aware of any active vulnerability that would allow such access, but that doesn't mean that it doesn't exist. There could have been one if OpenWrt used OpenSSH instead of Dropbear by default, but we dodged that one. (EDIT: on second thought, having no login shell would likely prevent access through SSH, but RCEs don't need login shells) My point is, we can't always assume that root is the only account in OpenWrt. The nobody account exists as a privilege reduction measure, and LPEs circumvent it. I agree that it's rarely a concern, but it's not always not a concern. ---
**Author:** ![howl](https://forum.openwrt.org/user_avatar/forum.openwrt.org/howl/32/135606_2.png) [@howl](https://forum.openwrt.org/u/howl)\ **Post date:** [November 6, 2026, 1:20pm UTC](https://forum.openwrt.org/t/numerous-kernel-exploits-and-vulnerabilities/255231/11 "2026-11-06T13:20:21Z")
> [@flygarn12](#): > > There are also some still using WEP!? I think XBOX WiFi pad connections appears as WEP in some software. If you have interest on it you can search about it as my experience is only that I could know a mate was playing with his XBOX 😃 All this thing happening is normal as is very difficult to follow all the execution stack for a person, there is where are winning AI analysis. Anyway I still believe the security by obscurity is still not an option, the only security concern could be if the new ways to audit software was only used by malicious persons, but the reality is that heavy to rely on software developers are using it to prevent it before.