Details and PoC Exploit Released for Linux nf_tables Vulnerability CVE-2026-23111

Google’s kernelCTF program has published full technical details and a working proof-of-concept exploit for CVE-2026-23111. This Linux nf_tables vulnerability is a use-after-free bug in the kernel’s Netfilter packet filter. A local attacker can use it to gain root and escape a container. Red Hat rates the flaw 7.8 (High) on the CVSS scale.

TL;DR

A one-character logic error lets an attacker drain a chain’s reference count. The kernel then frees the chain while it is still in use. The write-up and PoC exploit code are now public. Together, they turn the bug into root code execution on Container-Optimized OS. Patched kernels have been available since February 2026.

Why It Matters

Public exploit code changes the risk picture for this Linux nf_tables vulnerability. Anyone can now study a proven path from an unprivileged user to root. In addition, the bug lives in nf_tables, which most distributions enable by default.

The flaw needs the CAP_NET_ADMIN capability. However, the researchers note that unprivileged user namespaces grant this capability to normal users on many systems. As a result, shared hosts and container platforms face the most exposure.

So far, CISA’s ADP assessment lists exploitation as “none,” and the flaw is not in the KEV catalog. Even so, the public PoC lowers the bar for attackers.

How the Attack Works

The root cause

The bug sits in nft_map_catchall_activate(), a function that runs when a failed nf_tables transaction rolls back. It should restore inactive “catchall” map elements. Instead, it does the opposite.

The CVE record explains the logic error: “It should skip elements that are already active (they don’t need re-activation) and process elements that are inactive (they need to be restored). Instead, the current code does the opposite.”

Consequently, each aborted delete operation lowers a chain’s reference count without restoring it. Once the count hits zero, the kernel frees the chain while map elements still point to it. The upstream fix simply removes a single negation operator.

From bug to root

The kernelCTF exploit chains several stages, and the write-up explains each one in detail. First, it reclaims the freed chain memory with other kernel objects. Next, it turns that slab-level bug into a page-level use-after-free. From there, it corrupts page tables to gain physical memory read and write access.

The researchers also describe two new techniques. One bypasses physical address randomization with a simple linear memory scan and no information leak. In their words, “physASLR provides limited protection against attackers with physical memory access.” The other abuses an unexpected kfree() behavior to free a whole memory page.

Finally, the exploit changes a kernel setting so the system runs the attacker’s program as root outside the container. The team reports a 60 to 70 percent success rate before post-exploitation. That figure drops to 20 to 30 percent when it includes the final container escape step.

You can review the full write-up in the kernelCTF CVE-2026-23111 proof-of-concept repository.

Affected Versions

According to the researchers, the Linux nf_tables vulnerability arrived in Linux 6.4 and lasted until 6.19. Meanwhile, the CVE record shows that backports also brought the bug into older stable branches, starting with 5.15.121 and 6.1.36. The exploit targeted Container-Optimized OS build cos-121-18867.294.100.

Patch and Mitigation

With the kernelCTF exploit now public, admins should update to a fixed kernel soon. According to the CVE record, these versions contain the fix:

• 5.15.200 or later
• 6.1.163 or later
• 6.6.124 or later
• 6.12.70 or later
• 6.18.10 or later
• 6.19 and newer

If you cannot patch yet, restrict unprivileged user namespaces. For example, many distributions let admins disable them through a sysctl setting. Also, block nf_tables access in container seccomp profiles where workloads do not need it.

These steps reduce exposure, but they do not fix the Linux nf_tables vulnerability itself. Patching remains the only full fix. Cloud users running Container-Optimized OS should check Google’s release notes for their image version.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.