Linux Kernel nf_tables Flaw CVE-2026-23111 Enables Local Root Escalation
Security researchers have released a fully working exploit for CVE-2026-23111, a one-character use-after-free vulnerability in the Linux kernel's nf_tables packet-filtering subsystem that allows an unprivileged local user to escalate to root and escape container sandboxes. The flaw, caused by an inverted check in nf_tables, was patched upstream on February 5, 2026, with the fix consisting of a single removed line. Exodus Intelligence published its complete technical write-up on June 8, following an independent reproduction by FuzzingLabs on April 16. Ubuntu rates the issue CVSS 7.8 (high), and Exodus researcher Oliver Sieber—who discovered the bug in early 2025—demonstrated a full local-root chain on Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. FuzzingLabs also reproduced the bug on RHEL 10 ahead of Pwn2Own Berlin 2026 via a different exploitation path.
The attack is reachable on most default Linux installations because it only requires nf_tables and unprivileged user namespaces, both of which ship enabled on most desktop and many server distributions. There is no remote vector; the bug is a post-foothold escalation tool that turns a low-privileged shell, a compromised container, or a hijacked service account into full root on the host. The exploit triggers the use-after-free, bypasses kernel memory protections such as KASLR and SMAP, and seizes control of execution to grant root and break out of the container's namespace. Defenders can use a port scanner to audit exposed services and identify potential initial-access vectors that an attacker might chain with this flaw.
CVE-2026-23111 lands amid a dense cluster of Linux local-root disclosures, including CopyFail, the Dirty Frag chain, Fragnesia, DirtyDecrypt, and a nine-year-old ptrace flaw capable of reading /etc/shadow. The common thread is alarming: an unprivileged foothold keeps converting into root on ordinary, unmodified installs. Ubuntu has shipped fixes for 22.04, 24.04, and 25.10, while Debian patched Bookworm and Trixie with a 6.1 backport for Bullseye LTS. Red Hat, SUSE, and Amazon Linux are tracking the flaw as well—administrators should consult their distribution's advisory and apply the matching kernel package immediately, then reboot. For broader system hardening, run a privacy checkup and review namespace restrictions to determine whether untrusted users or workloads can still create unprivileged user namespaces on patched hosts.