CVE-2026-23111: Linux nf_tables Flaw Enables Root Exploits


CVE-2026-23111: Linux nf_tables Flaw Enables Root Exploits

Pierluigi Paganini
June 09, 2026

A Linux kernel nf_tables bug lets local users gain root via use-after-free caused by a logic error; patch removes a single “!”.

CVE-2026-23111 lives in nf_tables, the Linux kernel’s packet filtering framework. Exodus Intelligence researcher Oliver Sieber found the bug in early 2025 and chained it into a full local privilege escalation. The flaw was addressed on February 5, 2026, by simply removing one character from the source code. That character was a !.

“An inverted condition on the catchall element in the Abort Phase of nf_tables transactions allows an unprivileged user to trigger a use-after-free.” reads the report published by FuzzingLabs. “This UAF can be used to leak the kernel base address, then a heap address, and finally to execute a ROP chain that stack pivot into msg_msg-2k to get root privileges.”

The mechanics aren’t complicated to follow once you know where to look. When nf_tables processes a batch of transactions and something fails mid-way, it runs an abort phase to undo the changes. That abort phase calls nft_map_catchall_activate() to restore catchall elements in verdict maps. The function has the condition backwards: it skips the elements it should restore and tries to restore the ones that are already fine.

“The consequence is that when a DELSET operation is aborted, nft_setelem_data_activate() is never called for the catchall element.” continues the report. “For NFT_GOTO verdict elements, this means nft_data_hold() is never called to restore the chain->use reference count. Each abort cycle permanently decrements chain->use. Once chain->use reaches zero, DELCHAIN succeeds and frees the chain while catchall verdict elements still reference it, resulting in a use-after-free. This is exploitable for local privilege escalation from an unprivileged user via user namespaces + nftables on distributions that enable CONFIG_USER_NS and CONFIG_NF_TABLES. Fix by removing the negation so the check matches nft_mapelem_activate(): skip active elements, process inactive ones.”

Each aborted transaction drains the reference count by one. When it hits zero, the kernel frees the chain. Objects that still hold pointers to it don’t know that.

Sieber’s exploit triggers this sequence across four batches: delete the pipapo set and force an abort, toggle the generation cursor with a clean batch, delete the set for real, then delete the now-zero-refcount chain.

“Although the exploit triggers the use-after-free vulnerability multiple times to leak the kernel base address, leak heap addresses, and hijack the control flow, the stability tests resulted in a stability of >99% on an idle system.” reads the report published by Exodus, which discovered the flaw.

Even under heavy load tests (like Apache benchmark), performance only dropped to about 80%, which is still considered quite good and usable.

The exploit was demonstrated on Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. FuzzingLabs took a different angle for their independent reproduction. They built their exploit targeting RHEL 10 ahead of Pwn2Own Berlin 2026, using a different ROP approach: instead of hijacking control flow through blob_gen_0, they triggered nft_chain_validate on the freed chain, which walks expressions and calls expr->ops->validate, a function pointer they control. To get root without returning cleanly to userland, they overwrote modprobe_path, disabled SELinux enforcement by zeroing the enforcing field in selinux_state, and put the kernel to sleep with msleep to trigger the payload from a separate process.

The attack requires nf_tables and unprivileged user namespaces, both enabled by default on most desktop and many server distributions. There’s no remote vector. This is a post-foothold bug: you need a local shell, a container escape context, or a compromised service account. Ubuntu has released kernel fixes for 22.04, 24.04, and 25.10. Debian fixed Bookworm and Trixie, with a 6.1 backport for Bullseye LTS. Red Hat, SUSE, and Amazon Linux track it too.

The fix patch was published February 5. FuzzingLabs published a working root exploit on April 16. Exodus published its full technical walkthrough on June 8. That’s a four-month window between patch and detailed exploitation guide, which sounds comfortable until you remember most infrastructure doesn’t reboot on a four-month cadence.

“A single character was removed: an exclamation mark. That tiny negation was enough to invert the activation logic in the abort path, which eventually enables a use-after-free.” concludes FuzzingLabs.

The researchers recommend that users update their kernel and reboot. If they can’t do that yet, the company urges restricting unprivileged user namespaces to block the exploit path until they can.

CVE-2026-23111 is part of a recent wave of Linux local privilege escalation vulnerabilities. Recently, multiple flaws have been disclosed, including Copy Fail, Dirty Frag and its Fragnesia variant, DirtyDecrypt, and an older ptrace bug.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Linux)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


I am a recent convert to physical media — yet even as someone getting back into buying discs in 2026, I haven’t been buying Blu-rays. Like many Americans, I still pick up DVDs instead. These aren’t great times for the Blu-ray format, and don’t expect a turnaround in 2026.

Fewer new releases make their way to Blu-ray

More media is now released exclusively for streaming

Blu-ray has been around for two decades, but it never managed to fully replace, or even overtake, the DVD format it was designed to supersede. We still can’t take for granted that our favorite movies, let alone TV shows, will eventually see a Blu-ray release.

The movies most likely to come to Blu-ray are the ones that hit theaters, but a growing amount of cinema is designed exclusively with streaming platforms in mind. I recently rewatched Mississippi Masala, which led me to check in on what work Sarita Choudhury has done over the decades since. A film called Evil Eye released in 2020 caught my eye. Unfortunately, it’s only available via Prime Video. There’s no Blu-ray or even a DVD. In contrast, it’s easy to watch Michael B. Jordan in Sinners on Blu-ray, since that movie came to theaters last year.

You could say that it makes sense that a movie with a 4.8/10 rating on IMDb doesn’t see a physical release, but in the heyday of physical video, store shelves were stacked not only with just the big-budget bangers but plenty of straight-to-DVD movies as well. Now those films exist to pad out streaming catalogs instead.

Fewer big box stores stock their shelves with physical discs

Blu-ray discs have disappeared from some stores entirely

Best Buy store front
Best Buy

The format’s demise is striking. I frequent my local Best Buy quite often and don’t see any movies on display. That’s because the retailer stopped selling movies in stores several years ago. Walmart still sells them, but the selection is a fraction of what you could find ten or twenty years ago. The audience has been reduced down to the shrinking number of people whose internet at home can’t handle streaming and those who might think of themselves as collectors.

If you venture onto Reddit and visit r/Blu-ray, you will find more threads about thrift store hauls and older collections than excitement over the latest new release. Don’t get me wrong — I, too, am very excited about seeing what gems I can snag for only a couple bucks, but this shows the challenge retailers face. Increasingly, only enthusiasts are prepared to drop over $20 on a disc.

I’m not buying discs to stick them in a player

Phone on a stand playing a Netflix video Credit: Bertel King / How-To Geek

The simple truth is that most people don’t want to buy physical media. Discs don’t fit in phones, and the drives are no longer available in most laptops. Even desktop PCs lack a place to put a disk. I recently built a PC for the first time in part to digitize my media library, and I rely on an external DVD drive connected via USB. Yes, DVD, not Blu-ray. A smaller file size combined with upscaling is easier on my hard drive.

Retro nostalgia hasn’t helped Blu-ray in the same way it has aided vinyl. This is in part because most people simply don’t care all that much about video quality. Most are streaming video on Netflix and YouTube at middling settings on small screens, and many of us are acclimated to mid-range phone speakers, compared to which even the subpar built-in speakers on modern TVs sound like a huge step-up. It’s hard to convince large numbers of people to purchase an expensive version of a movie in a format that requires thousands of dollars of home media equipment to truly appreciate.

4K Ultra HD is in an even worse position

It’s been a decade, yet few people own these discs

The 4K Ultra HD Blu-ray format is an enhancement, rather than a replacement, of the Blu-ray discs that first appeared in 2006. Debuting in 2016, the 4K Ultra HD format supports the max resolution of a 4K TV.

4K TVs were still somewhat of a novelty ten years ago, but they’re cheap and commonplace today. Still, people aren’t demanding 4K-quality Blu-ray movies as a result. These discs are still less common than 1080p ones, which are themselves still outnumbered by DVDs.

This isn’t merely a matter of consumers preferring the cheaper option. Often, 4K simply isn’t a choice, or it’s one that arrives significantly later, like the Switch port of a PC title. Some recent films, like Exit 8, are slated to see a physical release over the summer yet will still be in 1080p when they do. Adoption of the newest format has been that slow.

The industry isn’t helping itself, either. 4K Ultra HD Blu-ray discs come with DRM and aren’t easy to play on a modern PC, further limiting potential growth. They do not want anyone pirating these super high-quality versions. When you consider that some of these 4K Blu-rays have an AI upscaling problem, you’re paying more for what may not even be the best version.​​​​​​​


Blu-ray is seeing fewer releases, is available in fewer places, and is less accessible in the ways many of us want to watch TV shows and movies in 2026. With our portable devices getting better and internet speeds getting faster, it’s hard to see physical video staging a turnaround, even if we’re still a long way off from it going away entirely.



Source link