Critical Local Privilege Escalation in Linux Kernel nf_tables (CVE‑2026‑23111) Enables Root Access

Critical Local Privilege Escalation in Linux Kernel nf_tables (CVE‑2026‑23111) Enables Root Access

What It Is — A use‑after‑free bug in the Linux kernel’s nf_tables packet‑filtering subsystem allows an unprivileged local user to execute arbitrary code and obtain root privileges. The flaw stems from an inverted condition in the abort‑phase logic that frees a chain while references to it remain.

Exploitability — Public PoC released by Exodus Intelligence; exploit stability >99 % on idle systems. Patch released 5 Feb 2026 (removes a stray “!”). CVSS v3.1 base score ≈ 9.8 (Critical).

Affected Products — All Linux distributions shipping a kernel with CONFIG_NF_TABLES and CONFIG_USER_NS enabled (e.g., Ubuntu 22.04+, Debian 12, RHEL 9, SUSE Leap 15.5, many cloud images).

TPRM Impact — Any third‑party service that runs Linux containers, VMs, or bare‑metal servers is exposed to privilege‑escalation risk, potentially compromising tenant isolation, data confidentiality, and service integrity.

Recommended Actions –

• Verify kernel version ≥ 5.19.13 (or vendor‑specific patched release).
• If immediate patching is not possible, disable CONFIG_USER_NS or unload nf_tables (modprobe -r nf_tables).
• Conduct asset inventory to identify all workloads using nf_tables.
• Update CI/CD pipelines to enforce patched base images.
• Review logs for abnormal nft command usage or unexpected process privilege changes.

Source: Security Affairs