One-character nf_tables bug lets local users gain root

A one-character bug in the Linux kernel’s nf_tables packet-filtering code can let an unprivileged local user gain root and break out of a container. The flaw is tracked as CVE-2026-23111. The upstream kernel fix was released Feb. 5, 2026. Public exploit write-ups appeared April 16 and June 8. Ubuntu assigned a CVSS score of 7.8 (high).

The bug is a use-after-free that arose from an inverted conditional check in the nf_tables code. The upstream patch removed a single character in a one-line change to correct the condition and stop the free-after-use scenario.

Two independent teams published working demonstrations. FuzzingLabs published a reproduction on April 16. Exodus Intelligence published a full technical walkthrough on June 8. Exodus researcher Oliver Sieber located the bug in early 2025 and demonstrated a chained exploit that converts the use-after-free into local root and a container namespace escape.

Exploitation requires local access and unprivileged user namespaces, a Linux feature that allows ordinary accounts to act as root inside private sandboxes. nf_tables and unprivileged user namespaces are enabled by default on many desktop systems and on some server installations, so any distribution that shipped a vulnerable kernel with those features enabled may be exposed. The flaw does not provide a remote attack path on its own; it is a post-foothold escalation technique.

Distributions including Ubuntu, Debian, Red Hat, SUSE and Amazon Linux have issued advisories and fixes. Ubuntu lists fixes for 22.04, 24.04 and 25.10. Debian fixed Bookworm and Trixie and provided a 6.1 backport for Bullseye LTS. The exact fixed kernel package varies by distribution and release; administrators must check their vendor advisory to identify the correct update.

Vendors and security teams recommend applying vendor kernel updates and rebooting affected systems. Systems that permit untrusted users or workloads to create unprivileged user namespaces should be prioritized for patching or temporarily restricted until updates are applied.

CVE-2026-23111 appears amid several recent local privilege escalation disclosures, including Copy Fail, the Dirty Frag chain and its Fragnesia variant, DirtyDecrypt, and an older ptrace issue that can expose /etc/shadow and run commands as root. There are no public reports of exploitation in the wild tied to this nf_tables flaw.