CVE-2026-23111: Linux Kernel nf_tables Use-After-Free Enables Local Privilege Escalation and Container Escape

CVE-2026-23111 (TL-2026-0731), also tracked as Off By !, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-06-09. It has no confirmed attribution, affects Debian Linux Kernel, references 2 CVEs (CVE-2026-23111, CVE-2026-23278), maps to 18 MITRE ATT&CK techniques (T1005, T1059, T1068), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-0731

Threat ID
TL-2026-0731
Also known as
Off By !, One-Character Linux Kernel Flaw
Severity
HIGH
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-09
Last reviewed
2026-06-09
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, cloud, hosting, financial, government, telecommunications
Target regions
Global
Detection rules
9
Indicators of compromise
24

Malware and tooling in CVE-2026-23111

Malware and tooling: Exodus Intelligence 'Off By !' PoC exploit, FuzzingLabs CVE-2026-23111 reproduction exploit

A use-after-free in the Linux kernel's nf_tables packet-filtering subsystem, caused by a single inverted negation (a stray '!') in nft_map_catchall_activate(), lets an unprivileged local user permanently decrement a chain reference count, free a still-referenced chain, and hijack kernel control flow to obtain root and escape containers. Exploitation requires unprivileged user namespaces; multiple public PoCs exist (FuzzingLabs, Exodus Intelligence) with >99% reliability on idle systems, though no in-the-wild exploitation has been reported.

How CVE-2026-23111 works

CVE-2026-23111 is a high-severity use-after-free (UAF) vulnerability in the Linux kernel's netfilter nf_tables subsystem. The root cause is a single inverted condition (an extra '!' negation operator) in nft_map_catchall_activate(). During the abort phase of an nf_tables transaction, the inverted check causes the function to skip elements that are actually active (and re-activate already-active ones), so when a DELSET operation against a pipapo-backed verdict map is aborted, nft_setelem_data_activate()/nft_data_hold() is never called for the catchall element. For an NFT_GOTO/NFT_JUMP verdict element this means the referenced chain's chain->use reference counter is never restored. Each abort cycle permanently decrements chain->use; once it reaches zero, a subsequent DELCHAIN succeeds and frees the regular chain while catchall verdict elements still reference it, producing the UAF.

The public exploits weaponize this with classic kernel heap-grooming. The freed nft_chain name buffer (allocated in slab caches such as kmalloc-cg-32 / kmalloc-cg-128 / kmalloc-cg-192) is reclaimed by attacker-influenced objects: a struct seq_operations sprayed via opening /proc/self/stat (single_open) places kernel function pointers into the freed chunk, and querying the rule via NFT_MSG_GETRULE causes nft_verdict_dump() to leak that buffer back to userspace, defeating KASLR. A second leak using a 192-byte chain name reclaimed by an nft_rule's list_head pointers yields a heap address. The attacker then overwrites the chain's blob_gen_0 / a fake nft_expr_ops structure so that an eval/validate function pointer points to a stack-pivot gadget (push_rbx_pop_rsp_pop_rbp on Debian 6.12.8-1; push_rdi_pop_rsp_pop_r13_pop_rbp on Ubuntu), pivoting into an attacker-controlled ROP chain staged in heap data (including msg_msg-2k regions). The ROP chain calls prepare_kernel_cred(&init_task) -> commit_creds() to gain root, __rcu_read_unlock(), and switch_task_namespaces() with init_nsproxy to break container/namespace isolation, then returns to usermode. The FuzzingLabs RHEL 10 variant alternatively walks IPC radix trees from init_ipc_ns to locate msg_msg-2k, overwrites modprobe_path, and disables SELinux via selinux_state.enforcing.

Exploitation requires only local access (a shell or compromised service account) on a kernel with CONFIG_NF_TABLES and unprivileged user namespaces (CONFIG_USER_NS) enabled - the default on most desktop and many server distributions. On Ubuntu 24.04 the AppArmor user-namespace restriction is bypassed via 'aa-exec -p trinity -- unshare'. Reported stability is >99% on idle systems, ~80% under heavy load. The vulnerability was discovered in early 2025 by Oliver Sieber of Exodus Intelligence, patched upstream on 2026-02-05 by removing a single character, independently reproduced and published by FuzzingLabs on 2026-04-16 (ahead of Pwn2Own Berlin 2026, targeting RHEL 10), and detailed in a full Exodus Intelligence walkthrough on 2026-06-08. A closely related defect (CVE-2026-23278, an erroneous break statement in the same code) was identified during analysis. No in-the-wild exploitation or threat-actor attribution has been reported.

MITRE ATT&CK techniques used in TL-2026-0731

Collection

T1005 Data from Local System

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1129 Shared Modules

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host

Initial Access

T1078 Valid Accounts

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery; T1613 Container and Resource Discovery

Defense Evasion

T1211 Exploitation for Stealth

Persistence

T1546 Event Triggered Execution

stealth

T1574 Hijack Execution Flow

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in CVE-2026-23111

  • Debian — Linux Kernel
    Vulnerable versions: Bookworm; Trixie; 6.12.8-1
    Fixed in: Bookworm patched; Trixie patched; 6.1 backport for Bullseye LTS
  • Canonical — Ubuntu Linux Kernel
    Vulnerable versions: 22.04 LTS; 24.04 LTS; 25.10
    Fixed in: 22.04 patched; 24.04 patched; 25.10 patched
  • Red Hat — Red Hat Enterprise Linux Kernel
    Vulnerable versions: RHEL 10; 6.12.0-124.38.1.el10_1
    Fixed in: RHEL 10 patched
  • SUSE — SUSE Linux Enterprise Kernel
    Vulnerable versions: tracked
    Fixed in: see SUSE advisory
  • Amazon — Amazon Linux Kernel
    Vulnerable versions: tracked
    Fixed in: see Amazon Linux advisory
  • Linux — Linux Kernel (upstream, CONFIG_NF_TABLES + CONFIG_USER_NS)
    Vulnerable versions: pre-2026-02-05 builds
    Fixed in: builds with commit f41c5d151078c5348271ffaf8e7410d96f2d82f8

Remediation for CVE-2026-23111

Patches

  • Upstream kernel commit f41c5d151078c5348271ffaf8e7410d96f2d82f8 (removes the inverted check)
  • Vendor kernel updates from Ubuntu, Debian, Red Hat, SUSE, and Amazon Linux

Immediate actions

  • Update the Linux kernel to a patched build (incorporating commit f41c5d151078c5348271ffaf8e7410d96f2d82f8) and reboot
  • Apply distribution patches: Ubuntu 22.04/24.04/25.10, Debian Bookworm/Trixie (and 6.1 backport for Bullseye LTS), RHEL 10

Workarounds

  • Disable unprivileged user namespaces: sysctl -w kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or user.max_user_namespaces=0
  • Restrict CONFIG_NF_TABLES access where feasible and block userns creation via AppArmor/seccomp profiles
  • Block 'aa-exec -p trinity -- unshare' style AppArmor profile abuse on Ubuntu 24.04

Longer-term hardening

  • Deploy EDR with kernel-exploit behavioral detection for unprivileged-namespace + nftables abuse
  • Adopt a kernel patch SLA and reboot/live-patch cadence for privilege-escalation CVEs
  • Audit container hosts for unnecessary CAP_NET_ADMIN and unprivileged user-namespace exposure

CVEs associated with CVE-2026-23111

CVE-2026-23111, CVE-2026-23278

Weaknesses (CWE) in CVE-2026-23111

CWE-416, CWE-672, CWE-911

Timeline of CVE-2026-23111

  • Vulnerability discovered in early 2025 by Oliver Sieber of Exodus Intelligence in the nf_tables abort-phase catchall handling.
  • Upstream Linux kernel patch deployed (commit f41c5d151078c5348271ffaf8e7410d96f2d82f8), removing the inverted '!' check in nft_map_catchall_activate().
  • FuzzingLabs published an independent reproduction and exploit, demonstrated on RHEL 10 (kernel 6.12.0-124.38.1.el10_1) ahead of Pwn2Own Berlin 2026.
  • nf_tables targeted as an attack surface for the Pwn2Own Berlin 2026 competition.
  • Related defect CVE-2026-23278 (erroneous break statement in the same nf_tables code) identified during analysis.
  • The Hacker News and Security Affairs reported public weaponized exploits for CVE-2026-23111; Ubuntu rated it CVSS 7.8 (High).
  • Exodus Intelligence released the full technical walkthrough 'Off By !' detailing the UAF, KASLR bypass, and ROP-based root/container escape.
  • Threadlinqs began tracking; distribution patches available across Debian, Ubuntu, RHEL, with SUSE and Amazon Linux tracking. No in-the-wild exploitation reported.

Sources cited for CVE-2026-23111

Threats related to CVE-2026-23111

Detection coverage for TL-2026-0731

As of 2026-06-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0731 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats