# CVE-2026-23111: Linux Kernel nf_tables Use-After-Free Enables Local Privilege Escalation and Container Escape

> A use-after-free in the Linux kernel's nf_tables packet-filtering subsystem, caused by a single inverted negation (a stray '!') in nft_map_catchall_activate(), lets an unprivileged local user permanently decrement a chain reference count, free a still-referenced chain, and hijack kernel control flow to obtain root and escape containers. Exploitation requires unprivileged user namespaces; multiple public PoCs exist (FuzzingLabs, Exodus Intelligence) with >99% reliability on idle systems, though no in-the-wild exploitation has been reported.

- **Published:** 2026-06-09T00:00:00Z
- **Last reviewed:** 2026-06-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0731
- **ID:** TL-2026-0731
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-23111, CVE-2026-23278

## Description

CVE-2026-23111 is a high-severity use-after-free (UAF) vulnerability in the Linux kernel's netfilter nf_tables subsystem. The root cause is a single inverted condition (an extra '!' negation operator) in nft_map_catchall_activate(). During the abort phase of an nf_tables transaction, the inverted check causes the function to skip elements that are actually active (and re-activate already-active ones), so when a DELSET operation against a pipapo-backed verdict map is aborted, nft_setelem_data_activate()/nft_data_hold() is never called for the catchall element. For an NFT_GOTO/NFT_JUMP verdict element this means the referenced chain's chain->use reference counter is never restored. Each abort cycle permanently decrements chain->use; once it reaches zero, a subsequent DELCHAIN succeeds and frees the regular chain while catchall verdict elements still reference it, producing the UAF.

The public exploits weaponize this with classic kernel heap-grooming. The freed nft_chain name buffer (allocated in slab caches such as kmalloc-cg-32 / kmalloc-cg-128 / kmalloc-cg-192) is reclaimed by attacker-influenced objects: a struct seq_operations sprayed via opening /proc/self/stat (single_open) places kernel function pointers into the freed chunk, and querying the rule via NFT_MSG_GETRULE causes nft_verdict_dump() to leak that buffer back to userspace, defeating KASLR. A second leak using a 192-byte chain name reclaimed by an nft_rule's list_head pointers yields a heap address. The attacker then overwrites the chain's blob_gen_0 / a fake nft_expr_ops structure so that an eval/validate function pointer points to a stack-pivot gadget (push_rbx_pop_rsp_pop_rbp on Debian 6.12.8-1; push_rdi_pop_rsp_pop_r13_pop_rbp on Ubuntu), pivoting into an attacker-controlled ROP chain staged in heap data (including msg_msg-2k regions). The ROP chain calls prepare_kernel_cred(&init_task) -> commit_creds() to gain root, __rcu_read_unlock(), and switch_task_namespaces() with init_nsproxy to break container/namespace isolation, then returns to usermode. The FuzzingLabs RHEL 10 variant alternatively walks IPC radix trees from init_ipc_ns to locate msg_msg-2k, overwrites modprobe_path, and disables SELinux via selinux_state.enforcing.

Exploitation requires only local access (a shell or compromised service account) on a kernel with CONFIG_NF_TABLES and unprivileged user namespaces (CONFIG_USER_NS) enabled - the default on most desktop and many server distributions. On Ubuntu 24.04 the AppArmor user-namespace restriction is bypassed via 'aa-exec -p trinity -- unshare'. Reported stability is >99% on idle systems, ~80% under heavy load. The vulnerability was discovered in early 2025 by Oliver Sieber of Exodus Intelligence, patched upstream on 2026-02-05 by removing a single character, independently reproduced and published by FuzzingLabs on 2026-04-16 (ahead of Pwn2Own Berlin 2026, targeting RHEL 10), and detailed in a full Exodus Intelligence walkthrough on 2026-06-08. A closely related defect (CVE-2026-23278, an erroneous break statement in the same code) was identified during analysis. No in-the-wild exploitation or threat-actor attribution has been reported.

## MITRE ATT&CK

- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1078 Valid Accounts
- T1106 Native API
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1546 Event Triggered Execution
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1613 Container and Resource Discovery
- T1518 Software Discovery
- T1574 Hijack Execution Flow
- T1005 Data from Local System
- T1129 Shared Modules

## Sources

- [Off By !: Exploiting a Use-after-Free in the Linux Kernel](https://blog.exodusintel.com/2026/06/08/off-by-exploiting-a-use-after-free-in-the-linux-kernel/)
- [Reproducing CVE-2026-23111: How One Character Can Change Everything](https://fuzzinglabs.com/repro-cve-2026-23111/)
- [One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public](https://thehackernews.com/2026/06/one-character-linux-kernel-flaw-enables.html)
- [CVE-2026-23111: Linux nf_tables Flaw Enables Root Exploits](https://securityaffairs.com/193352/hacking/cve-2026-23111-linux-nf_tables-flaw-enables-root-exploits.html)
- [CVE-2026-23111: Linux Kernel Privilege Escalation Flaw](https://www.sentinelone.com/vulnerability-database/cve-2026-23111/)
- [CVE-2026-23111: Local Privilege Escalation Vulnerability in Linux Kernel Utilizing Netfilter](https://securityvulnerability.io/vulnerability/CVE-2026-23111)
- [CVE-2026-23111 - NVD Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-23111)
- [Upstream patch commit f41c5d151078c5348271ffaf8e7410d96f2d82f8](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f41c5d151078c5348271ffaf8e7410d96f2d82f8)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0731