cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Public Exploits for Linux CVE-2026-23111 Enable Local Root Access

· Original article ↗

Summary

Public exploits for Linux kernel CVE-2026-23111 demonstrate local privilege escalation to root and container escape via nf_tables. The flaw requires a local foothold and unprivileged user namespaces; patching and rebooting are advised.

Key points

  • CVE-2026-23111 is a use-after-free in the Linux kernel’s nf_tables code that can allow an unprivileged local user to gain root and escape a container.
  • Exploitation requires a local foothold and access to unprivileged user namespaces; the flaw has no standalone remote vector.
  • Exodus Intelligence published a detailed exploit walkthrough on June 8, 2026; FuzzingLabs had independently reproduced the flaw and published an exploit in April.
  • The article reports demonstrations on Debian Bookworm and Trixie, Ubuntu 22.04 and 24.04, and reproduction on RHEL 10.
  • The upstream fix was released February 5, 2026. Distribution fixed-kernel versions vary; update the kernel and reboot.
  • The article reports no known exploitation in the wild and no threat actor attribution.

Article Details

Vulnerability Types
  • Use-after-free
Severity
CVSS 7.8 (High, per Ubuntu)
Affected Versions
  • Debian Bookworm
  • Debian Trixie
  • Ubuntu 22.04 LTS
  • Ubuntu 24.04 LTS
  • RHEL 10
Exploitation Status
not_reported
Exploit Availability
public_exploit
Patch Status
available
Workarounds
  • Restrict unprivileged user namespaces until the kernel fix is installed.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThe local exploit allows an unprivileged user to escalate to root.T1611 · Escape to HostThe exploit can let an attacker break out of a container to the host.

CVE

CVE-2026-23111Linux · Linux kernelSecurity researchers released a working exploit for CVE-2026-23111, a Linux kernel use-after-free in nf_tables that can let an unprivileged local user gain root and escape a container.

People

Oliver SieberExodus Intelligence researcher who found the flaw and developed an exploit to gain local root.

Products

Debian LinuxHe demonstrated it on Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.Linux kernelSecurity researchers released a working exploit for CVE-2026-23111, a Linux kernel use-after-free in nf_tables that can let an unprivileged local user gain root and escape a container.RHELFuzzingLabs independently reproduced the flaw on RHEL 10.UbuntuUbuntu rates the flaw CVSS 7.8 (high). If your distribution’s kernel package does not yet include the fix, update and reboot.

Related Articles