CVE-2026-23111: Linux Kernel nf_tables — Local Root Escalation Risk (June 2026)

CVE-2026-23111 — Linux Kernel nf_tables

CVE-2026-23111 is a high-severity vulnerability in the Linux kernel's nf_tables packet-filtering code, allowing unprivileged local users to escalate privileges to root. The flaw is actively exploited in the wild, with public exploits available since April 2026. No remote vector exists, but exploitation enables full host compromise and container breakout. Immediate patching and system reboot are required.

Attack Vector

The vulnerability is a use-after-free bug in nf_tables, triggered when unprivileged user namespaces are enabled. An attacker with local access can craft specific netlink messages to manipulate nf_tables objects, leading to memory corruption and arbitrary code execution as root. Exploitation does not require elevated privileges or special capabilities beyond a standard unprivileged user account with user namespaces enabled. There are no known IOCs specific to this exploit, but successful attacks result in privilege escalation and potential container escape.

Who Is at Risk

All major Linux distributions enabling nf_tables and user namespaces are affected, including Debian, Ubuntu, Red Hat, SUSE, and Amazon Linux. Both desktop and server deployments are at risk, especially in environments using containers or unprivileged user accounts. Systems running kernel versions prior to the upstream patch released on February 5, 2026, are vulnerable until patched and rebooted.

Patch & Mitigate

• Patch: Apply the upstream Linux kernel patch released February 5, 2026, or the latest vendor-provided kernel update for your distribution. Reboot is mandatory after patching.
• Workaround: If immediate patching is not possible, disable unprivileged user namespaces (where feasible) to reduce risk, or restrict local user access.
• Detect: Monitor for suspicious use of user namespaces, abnormal nf_tables netlink activity, or unexpected privilege escalations in system logs. Review for new root-level processes spawned by unprivileged users.

MITRE ATT&CK

• TA0004 — Privilege Escalation: Exploitation leads directly to root-level access from unprivileged accounts.
• TA0003 — Persistence: Attackers may use root access to establish persistence mechanisms on compromised hosts.

Source: https://thehackernews.com/2026/06/one-character-linux-kernel-flaw-enables.html