Google Publishes Linux Kernel Exploit for CVE-2026-23111

Google’s kernelCTF programme has published full technical details and a working proof-of-concept exploit for CVE-2026-23111, a use-after-free flaw in the Linux kernel’s Netfilter nf_tables. The vulnerability allows a local attacker to achieve root and escape from containers; Red Hat rates the flaw 7.8 (High) on the CVSS scale. The write-up notes that the PoC and accompanying exploit are public, and that patched kernels have been available since February 2026.

The CVE summary explains the root cause: nft_map_catchall_activate() should skip already active elements and restore inactive ones, but instead processes them in the reverse fashion. Each aborted delete operation lowers a chain’s reference count without restoring it, and when the count reaches zero, the kernel frees the chain while map elements still point to it. The upstream fix removes a single negation operator.

KernelCTF describes a multi-stage exploit chain, including reclaiming freed chain memory, achieving a page-level use-after-free, and corrupting page tables to gain memory read/write access. Two new techniques are highlighted: bypassing physASLR with a linear memory scan and an unexpected kfree() behaviour to free an entire memory page. The PoC repository is hosted in Google’s kernelCTF CVE-2026-23111_cos space, with exploitation details attributed to the kernelCTF team.

Affected versions are stated as Linux 6.4 through 6.19, with backports bringing the bug into older stable branches starting at 5.15.121 and 6.1.36. The article lists patched versions as 5.15.200 or later, 6.1.163 or later, 6.6.124 or later, 6.12.70 or later, 6.18.10 or later, and 6.19 or newer, and advises updating where possible.

It also notes that, if patching is not feasible, admins should restrict unprivileged user namespaces and consider disabling nf_tables in container seccomp profiles where workloads do not require it. The article emphasises that public PoC lowers the barrier for exploitation.