CVE-2026-23111 flaw in Linux nf_tables lets local users gain root

The article discusses CVE-2026-23111, a Linux kernel nf_tables bug that allows local users to gain root privileges via a use-after-free vulnerability. Discovered by researcher Oliver Sieber in 2025, the flaw originates from a logical error in the nf_tables package filtering framework. A simple patch was issued on February 5, 2026, which involved removing a single negation character from the source code.

This vulnerability can be exploited by unprivileged users in environments where user namespaces and nf_tables are enabled. Demonstrated on multiple Linux distributions (Debian, Ubuntu), the exploit showcased stable performance even under load. Various Linux distributions have released patches, emphasizing the importance for users to update their kernels and reboot.