CVE-2026-23111: Linux nftables UAF Vulnerability Grants Root Access

The cybersecurity landscape has recently been shaken by the disclosure of CVE-2026-23111, a severe Use-After-Free (UAF) vulnerability discovered within the Linux kernel’s nftables subsystem.

Originally unearthed by vulnerability researcher Oliver Sieber from Exodus Intelligence, this flaw stems from a seemingly innocuous logical error a single misplaced exclamation mark in the kernel’s source code.

Despite its simple origin, the implications are critical. This vulnerability allows an unprivileged local attacker to execute a sophisticated exploit chain, ultimately achieving Local Privilege Escalation (LPE) to root.

Successfully tested on major distributions, including Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS, the flaw highlights the ongoing complexities of securing core networking infrastructure.

This article provides a comprehensive technical analysis of CVE-2026-23111, breaking down the root cause, the exploitation mechanics, and the necessary mitigation steps for system administrators.

To fully grasp the mechanics of CVE-2026-23111, one must understand the underlying architecture of Netfilter and nftables. Netfilter is the fundamental packet filtering framework inside the Linux kernel, allowing modules to register callback functions across the network stack.

Its modern successor, nftables, provides a highly structured environment for defining rulesets through tables, chains, rules, and sets.

In nftables, the ruleset is evaluated via a series of expressions. When packets match specific criteria, “verdicts” (such as NFT_CONTINUE, NF_DROP, or NFT_GOTO) dictate the subsequent action.

Crucially, nftables utilizes “Sets” to manage selectors efficiently. Types like pipapo (Pile Packet Policies) handle complex range expressions. These sets can feature a “catchall” element a wildcard default used when no specific lookup matches.

To ensure atomic, transactional updates to rulesets without disrupting active network traffic, nftables employs Generation Masks.

This system tracks an object’s active state across the “current” and “next” generation using a 2-bit mask. Changes are staged in the next generation and committed all at once by flipping a generation cursor.

The crux of CVE-2026-23111 lies within the deletion phase of nftables verdict maps and a flawed abort process.

When a verdict map containing a catchall element (which references a specific chain) is slated for deletion, the system first deactivates the elements.

The catchall element is unlinked, and the referenced chain’s reference counter is decremented. However, if a secondary transaction fails within the same batch, the kernel triggers an abort process to revert the deletion.

This is where the catastrophic logical error occurs. The kernel executes the nft_map_catchall_activate() function to reactivate the elements and restore the chain’s reference counter.

But due to a flawed conditional check specifically, an incorrect logical NOT ! operator the function accidentally skips deactivated catchall elements and only attempts to activate elements that are already active.

Because the inactive catchall element is ignored, the chain’s reference counter remains at zero. The kernel is tricked into believing the chain is no longer needed, allowing it to be deleted.

However, a valid reference to the chain still exists elsewhere in the base chain. When the system attempts to access this now-deleted memory chunk, a Use-After-Free (UAF) condition is triggered.

Transforming this UAF bug into a reliable Local Privilege Escalation (LPE) requires a multi-stage exploitation strategy. The Exodus Intelligence team demonstrated a highly stable exploit chain (yielding >99% reliability on idle systems) by meticulously manipulating the kernel heap.

Because low-privileged users cannot issue commands on the default network namespace, the attacker first creates a new network namespace (bypassing restrictions in systems like Ubuntu 24.04 via unshare commands).

The attacker stages a ruleset with a base chain, a regular chain, and a pipapo set containing a catchall element pointing to the regular chain.

By sending a carefully crafted sequence of Netlink transaction batches including a deliberate error to trigger the flawed abort process the attacker forces the regular chain’s reference counter to zero, allowing its deletion while keeping a dangling pointer alive.

Defeating Kernel Address Space Layout Randomization (KASLR) is the next hurdle. The attacker crafts a chain name exactly 30 bytes long, forcing its allocation in the kmalloc-cg-32 cache. Once the chain is freed, the attacker opens /proc/self/stat, forcing the kernel to allocate a seq_operations structure into that exact memory chunk.

By querying the dangling rule, the kernel attempts to dump the deleted chain’s “name,” inadvertently leaking the seq_operations function pointers and exposing the kernel base address.

With KASLR bypassed, the attacker repeats the UAF process using larger chain names (140 bytes, allocated in kmalloc-cg-192). By spraying overlapping nft_rule structures, they overwrite list pointers and leak critical heap addresses.

To hijack the control flow, the attacker targets the nft_do_chain() packet evaluation function. When a packet hits the dangling reference, the kernel dereferences a deleted object (blob_gen_0) and blindly calls its expr->ops->eval function pointer.

The attacker overwrites this chunk with a fake object pointing to an attacker-controlled ROP (Return-Oriented Programming) chain.

The execution of the ROP chain slightly differs between distributions. On Debian, a push rbx; pop rsp; pop rbp gadget is used to pivot the stack.

On Ubuntu, an alternative push rdi; pop rsp stack pivoting gadget is required. In both environments, the ROP chain ultimately executes commit_creds(&init_cred) to elevate the process credentials to root, followed by namespace escapes to finalize the full system compromise.

Mitigation

The discovery of CVE-2026-23111 emphasizes the fragility of kernel-level memory management, where a single syntax oversight can unravel entire security models. The Linux kernel community moved swiftly, patching the vulnerability upstream on February 5, 2026.

Kernel Updates: Ensure all infrastructure running Debian, Ubuntu, or other Linux distributions is updated to the latest kernel versions deployed after February 2026.
Namespace Hardening: Where possible, restrict unprivileged user namespaces. While bypasses exist (as seen in Ubuntu 24.04), applying stringent AppArmor profiles and sysctl restrictions (kernel.unprivileged_userns_clone=0) drastically reduces the attack surface.
Monitoring: Monitor for unusual Netlink batch requests and unexpected network namespace creations originating from low-privileged user accounts.