One stray character in the Linux kernel’s nf_tables code led to a use-after-free that lets an unprivileged local user become root and escape a container. The flaw is tracked as CVE-2026-23111 and was fixed upstream on February 5, 2026. Working exploits are now public from multiple teams.
What happened
- CVE-2026-23111 is a use-after-free in
nf_tablescaused by an inverted check. The upstream fix removed the bad character in one line. - Ubuntu rates it CVSS 7.8 (high).
- Detailed exploitation was published by Exodus Intelligence on June 8, 2026 (technical walkthrough). FuzzingLabs released an independent reproduction back in April.
Who is affected
- Systems with
nf_tablesand unprivileged user namespaces enabled. This combination is common. Both ship by default on most desktops and many server builds. - There is no remote vector on its own. Attackers use it after gaining a foothold to turn a low-privileged shell, a compromised container, or a service account into root on the host.
How it was exploited
- Exodus researcher Oliver Sieber found the bug in early 2025 and chained it into a full local root. The exploit triggers the use-after-free, works around kernel memory protections, then takes control to grant itself root and escape the container’s namespace.
- Demonstrated on: Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
- FuzzingLabs reproduced the bug on RHEL 10 ahead of Pwn2Own Berlin 2026, building a separate local-root path.
Timeline
- Feb 5, 2026: Upstream fix lands.
- Apr 16, 2026: FuzzingLabs publishes a working reproduction.
- Jun 8, 2026: Exodus Intelligence posts a full technical write-up.
Exposure across distributions
The technique is now documented across Debian, Ubuntu, and Red Hat. Because the bug is in mainline, any distribution that shipped a vulnerable kernel with both features enabled is exposed—unless distro hardening or namespace restrictions block the path.
Why this matters
This flaw lands amid a run of Linux local-root disclosures. Recent weeks brought Copy Fail, the Dirty Frag chain and its Fragnesia variant, DirtyDecrypt, and a nine‑year‑old ptrace flaw that reads /etc/shadow and runs commands as root. The details differ, but the pattern is the same: an unprivileged foothold keeps turning into root on ordinary installs.
What to do now
- Update your kernel and reboot.
- Prioritize systems where untrusted users or workloads can create unprivileged user namespaces.
- Check your distro advisories for the exact fixed package version:
- Ubuntu: fixes for 22.04, 24.04, and 25.10.
- Debian: Bookworm and Trixie fixed; 6.1 backport available for Bullseye LTS.
- Red Hat, SUSE, Amazon Linux: tracking the flaw; consult each advisory for the matching kernel build.
- If policy allows, limit or disable unprivileged user namespaces until all systems are patched.
Bigger picture
A recent review from Synacktiv ties the surge in Linux LPEs to AI‑assisted research and patch‑diffing that speed up exploit development, and argues that ordinary hardening still buys time. Many of these bugs depend on optional kernel features or loose defaults. Tightening what unprivileged users can reach—user namespaces here—helps hold the line until patches land.
Current outlook
- No public reports of exploitation in the wild.
- The patch has been available since February; exploit code has been public since April.
Reference: View article